Azure API Center EUVD-2026-95395

The CVSS vector states AV:N/AC:H/PR:N/UI:N - no authentication or user interaction is required, but AC:H indicates meaningful attacker-controlled preconditions (e.g. specific timing, request sequencing, or knowledge of target-specific values) that are not enumerated in the Microsoft advisory. The changed scope (S:C) implies the disclosure can cross the vulnerable component's security/authorization boundary, consistent with a multi-tenant cloud service. Because Azure API Center is a Microsoft-operated SaaS, exploitation is limited to the window before the vendor-side fix was deployed, and customers cannot self-mitigate beyond relying on that server-side patch. The practical limiting factor is the high attack complexity combined with the absence of any public exploit (E:U).

Signals are moderately consistent but point to a lower real-world urgency than the 8.7 base score alone suggests. The CVSS vector (AV:N/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with changed scope and high confidentiality/integrity impact, which drives the high score. However, the temporal metrics in the same vector are decisive: E:U (Exploit Code: Unproven) means no public exploit is known, RL:O confirms an official remediation exists, and RC:C marks the report as confirmed. AC:H (high attack complexity) further signals that exploitation is not trivial. No EPSS score and no CISA KEV entry were provided, and no POC is indicated - so there is no evidence of active or imminent exploitation. A notable internal conflict: the description characterizes this strictly as 'exposure of sensitive information' (a confidentiality issue), yet the vector asserts I:H (high integrity impact), which is inconsistent with a pure disclosure flaw - verify the integrity impact with Microsoft. Because Azure API Center is a Microsoft-managed cloud service, remediation is almost certainly applied vendor-side, further reducing customer-side urgency. Net: a confirmed, genuinely high-severity disclosure bug worth tracking, but not an emergency given high attack complexity, no known exploit, and vendor-hosted patching.

A remote, unauthenticated attacker crafts a sequence of network requests against the Azure API Center service to exploit a flaw that leaks sensitive information (potentially across a trust/tenant boundary, per the scope-changed vector). Success requires satisfying non-trivial preconditions (AC:H), so the attack is not a simple single request. No public exploit code exists, so any attempt would require original research or reverse-engineering the fix.