What is the CVSS score of EUVD-2026-37957?

EUVD-2026-37957 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Cost Management are affected by EUVD-2026-37957?

Microsoft Cost Management Interactive Experiences is vulnerable to unauthenticated disclosure of sensitive billing and cost allocation data.. A patch is available.

How to fix or mitigate EUVD-2026-37957?

24 hours: Identify all systems running Microsoft Cost Management Interactive Experiences and access the Microsoft security advisory for CVE-2026-47633 to obtain the specific patch version; deploy immediately upon verification. 7 days: Search access logs spanning at least 90 days prior to patch deployment for indicators of unauthorized access to cost and billing data. 30 days: Validate patch deployment across all organization instances and confirm absence of exploitation through access log review.

Microsoft Cost Management EUVD-2026-37957

| CVE-2026-47633 HIGH

Information Exposure (CWE-200)

2026-06-18 microsoft

GHSA-9854-5wcq-gf9p

Information Disclosure Microsoft Microsoft Cost Management

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-reachable SaaS endpoint, no auth or user interaction required per description, high confidentiality impact only; integrity and availability unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 22:17 vuln.today

CVE Published

Jun 18, 2026 - 21:37 cve.org

HIGH 7.5

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Cost Management Interactive Experiences allows unauthenticated remote attackers to retrieve sensitive data over a network. The flaw carries a CVSS 3.1 base score of 7.5 with high confidentiality impact and no integrity or availability effects, and Microsoft has published an advisory with a fix. At time of analysis there is no public exploit identified and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Microsoft Cost Management is a cloud-based Azure service that provides billing, budget, and cost-analysis dashboards (the 'Interactive Experiences' UI/API layer) for Azure subscriptions and enterprise agreements. The weakness is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the service returns data to a caller who should not be authorized to view it - typically caused by missing or broken authorization checks, insecure direct object references, or over-permissive API responses in the service tier. The single CPE 'cpe:2.3:a:microsoft:microsoft_cost_management:*:*:*:*:*:*:*:*' indicates the issue lies in the Microsoft-hosted service rather than on-premises software, so the fix is delivered server-side by Microsoft rather than as a customer-installed patch.

RemediationAI

Patch available per vendor advisory: Microsoft has remediated the issue server-side in the Cost Management service, so customers do not need to deploy updates themselves - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47633 to confirm the fix has been rolled out to your tenant and region. As a compensating control while validating exposure, restrict access to Cost Management blades and the Microsoft.CostManagement resource provider via Azure RBAC (limit Billing Reader, Cost Management Reader, and EA roles to required principals) and require Conditional Access with MFA on accounts that hold these roles; trade-off is that legitimate finance users may lose self-service access and require ticketed onboarding. Additionally, audit Azure Activity logs and Microsoft.CostManagement diagnostic logs for unexpected query patterns or anonymous-style calls to confirm no historical abuse occurred before the server-side fix.