Microsoft Azure Attestation EUVD-2026-99893

Exploitation requires network reachability to a running Microsoft Azure Attestation or Device Health Attestation Service endpoint that processes attestation requests; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against such an exposed service. The practical limiting factor is exposure: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-accessible are at risk, and affected on-prem builds are Windows Server 2019 (<10.0.17763.9376), 2022 (<10.0.20348.5761), and 2025 (<10.0.26100.33650). Impact is confined to information disclosure (C:H, I:N, A:N) - no code execution or service disruption - so risk is bounded by the sensitivity of memory recoverable from the service.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact and no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks memory contents. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; the 7.5 base score reflects potential severity, not observed activity. This is credible to prioritize for patching because it is remotely and unauthenticated-reachable against a Microsoft attestation service, but in the absence of KEV/EPSS/POC signals there is no evidence of active or imminent mass exploitation - it currently reads as a patch-on-cycle item rather than an emergency. Note a scoping nuance to verify with the vendor: the description names both the cloud 'Microsoft Azure Attestation service' and the on-premises 'Device Health Attestation Service,' yet the EUVD affected-version list enumerates only on-premises Windows Server builds, so the Azure-side exposure and remediation path are not confirmed by the supplied data.

A remote, unauthenticated attacker sends a crafted attestation request over the network to a vulnerable Azure Attestation or Windows Server Device Health Attestation endpoint, triggering an out-of-bounds read that returns adjacent process memory in the response. The leaked memory could contain sensitive data such as cryptographic material or other secrets usable for follow-on attacks. No public exploit was identified in the provided data, and the low attack complexity (AC:L) means no special timing or race conditions are required.