EUVD-2026-99575
GHSA-v4fc-vf8c-cw22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HDInsight endpoint over network
-
ExploitSend crafted unauthenticated request
-
ExecutionTrigger improper information exposure
-
ImpactReceive sensitive data in response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions indicated by the input - the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated exploitation requiring no user interaction against Azure HDInsight clusters running version 1.0 below build 2606012120. The only limiting factors evident from the data are: the target must be a deployed, network-reachable HDInsight instance at an unpatched version, and because HDInsight is a Microsoft-managed service, vendor-side patching may already have closed exposure for many tenants. The precise feature, protocol, or endpoint that leaks data is not named in the description and should be confirmed via the MSRC advisory. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact and no integrity or availability impact (C:H/I:N/A:N), yielding a base score of 7.5 (HIGH). No EPSS score, SSVC decision data, POC, or CISA KEV listing was provided in the input, so there is no evidence of active exploitation or published exploit code - the signal set is essentially 'high CVSS, unknown real-world exploitation.' The absence of KEV/POC/EPSS data should not be read as 'low risk'; it is simply missing, and because Azure HDInsight is a Microsoft-managed cloud service, remediation is typically applied centrally by the vendor rather than requiring customer action, which materially reduces the practical exposure window. Net: treat as a real but not emergency priority - the unauthenticated network vector warrants timely attention, but there is no confirmed exploitation to justify out-of-band response. One caveat to verify: the description says 'disclose information over a network' and CWE-200 is generic, so the exact nature and sensitivity of the disclosed data is not specified in the available input and should be confirmed with the Microsoft MSRC advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests over the network to an affected Azure HDInsight endpoint and retrieves sensitive information that should not be exposed to unauthorized actors. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special conditions are indicated. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Information disclosure in Microsoft Azure HDInsight (version 1.0 below build 2606012120) allows a remote, unauthenticated attacker requiring no user interaction to read sensitive data from network-reachable clusters, as reflected by the assessed CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), which caps impact at high confidentiality loss with no integrity or availability effect. This is a genuine but moderate-priority issue: it is tracked as EUVD-2026-99575, is reported by secure@microsoft.com, and a vendor patch is indicated, though no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Because HDInsight is a Microsoft-managed service, the practical exposure depends heavily on whether the target cluster is still running an unpatched build and whether its endpoints are network-reachable.
RemediationAI
Patch available per vendor advisory: consult the MSRC update guide for CVE-2026-85891 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85891) and follow Microsoft's guidance, upgrading affected Azure HDInsight 1.0 clusters to build 2606012120 or later, the boundary indicated by the EUVD affected-version range "Azure HDInsight 1.0 <2606012120"; for managed-service deployments, confirm the applied platform build with Microsoft support or through the Azure portal rather than assuming remediation. Until the upgrade is confirmed, apply compensating controls that target the remote, unauthenticated nature of the exposure: restrict network reachability to cluster endpoints using network security groups, Azure Firewall, private endpoints/Private Link, or IP allowlisting, accepting the trade-off that legitimate client and tooling access from non-approved networks will break; disable or firewall any HDInsight web UIs, gateways, or APIs not actively required, understanding that this removes functionality for dependent workloads; and increase monitoring/log review of cluster endpoint access for anomalous data retrieval, which detects but does not prevent leakage. No vendor-released patch version beyond the build boundary above is asserted by the available data, and no public exploit code or confirmed active exploitation was identified at time of analysis, so prioritization should follow the high confidentiality impact and remote unauthenticated reachability rather than an active-threat signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the general root-cause class covering cases where data - configuration, logs, credentials, metadata, or query results - is returned to a caller who is not authorized to receive it. In this case the disclosure is an over-the-network information leak in Azure HDInsight, Microsoft's managed Apache Hadoop/Spark/Hive/Kafka analytics platform, which exposes HTTP/REST gateways, web UIs, and cluster-adjacent service endpoints to client networks. The assessed vector AV:N/AC:L/PR:N/UI:N for the affected version confirms the leak is reachable remotely, needs no privileges, and requires no user interaction, but it does not identify the precise component, protocol, or endpoint that discloses data - the description intentionally omits that detail, so the exact leaking interface should be confirmed against the MSRC update guide entry. No CPE identifiers were included in the supplied intelligence, so affected-component mapping is limited to the Azure HDInsight 1.0 service line per the EUVD record (EUVD-2026-99575); the confidentiality-only impact scoring indicates the defect is a read/exposure path rather than an execution or denial-of-service primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description states unauthorized disclosure over a network, so AV:N/PR:N/UI:N with high confidentiality impact only (C:H, I:N, A:N) and unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
A high-severity information disclosure flaw in Microsoft Azure HDInsight allows anyone who can reach a cluster's network endpoints to read sensitive data without credentials or user interaction, meaning any data processed or stored on those clusters should be treated as potentially exposed. Because HDInsight frequently handles analytics workloads containing regulated or business-critical information, affected clusters represent a direct confidentiality risk to the organization and, where customer or partner data is involved, a potential contractual and regulatory exposure. Leadership should care because the attack path requires no insider access and no user mistake - only an unpatched, network-reachable cluster.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB