EUVD-2026-63691
GHSA-2qw7-7pgw-gpc4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-accessible unauthenticated service with no interaction; S:C reflects cross-component information disclosure; no integrity or availability impact confirmed by description.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration is required on the attacker's side - unauthenticated remote exploitation against Azure Stack HCI nodes whose management or service interfaces are reachable over a network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.6 (High) is driven by a fully unauthenticated, low-complexity, network-accessible attack surface (AV:N/AC:L/PR:N/UI:N) combined with Changed scope and High confidentiality impact (S:C/C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch available from the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69519. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Azure Stack HCI deployments and assess exposure to untrusted networks, consulting Microsoft Security Response Center for the current patch version and deployment instructions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Azure Stack Hci
View allAzure Stack HCI Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack c
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), th
Information disclosure in Microsoft Azure Compute Gallery permits an authenticated remote attacker to read sensitive dat
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today