Azure Attestation CVE-2026-66802

The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-accessible exploitation requiring no authentication and no user interaction, but with high attack complexity - meaning the race condition window must be reliably won, likely requiring concurrent or rapid repeated requests. The service must be reachable over the network; in Azure's managed offering this is typically internet-accessible by design. Limiting factors include: the high complexity of reliably winning a race condition (AC:H), the potential need for high-throughput concurrent connections to trigger the window, and the possibility that Azure-side rate limiting or WAF controls may interfere with repeated attempts. The 'Authentication Bypass' tag suggests the race condition may also allow bypassing attestation validation independently of the RCE path. No specific non-default configuration is stated as required - the vulnerability appears to affect the services as normally deployed.

The CVSS 8.1 score reflects high impact (C:H/I:H/A:H) tempered by high attack complexity (AC:H), which is appropriate for a race condition requiring precise timing to exploit reliably. The PR:N vector indicates no authentication is required to attempt exploitation, which is a significant concern for a cloud-facing attestation endpoint. However, AC:H means exploitation is not straightforward - an attacker must reliably win a timing race, which typically requires either high-bandwidth access to the target or repeated attempts, both of which increase detectability. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no confirmed public POC suggests this has not yet seen widespread opportunistic exploitation, though the tags include 'Authentication Bypass,' implying the race condition may undermine attestation integrity checks in ways beyond simple RCE. Organizations running attestation-dependent workloads - including zero-trust architectures relying on Device Health Attestation for conditional access - should treat this as urgent, since a compromised attestation service undermines the trust chain for all attested devices. EPSS data is missing and should be checked against NVD or FIRST once populated.

An attacker with network access to the Azure Attestation or Device Health Attestation endpoint sends a carefully timed sequence of concurrent requests designed to win a race condition in shared resource handling, corrupting service state in a way that redirects execution flow. If successful, the attacker achieves code execution within the attestation service process. No public POC has been identified, but the network-accessible, no-auth-required nature of the endpoint means exploitation attempts can be made without any foothold.