This vulnerability in Microsoft Azure Data Explorer (CVE-2026-21524) involves the exposure of sensitive information to unauthorized actors over a network, categorized as CWE-200. The CVSS 3.1 vector indicates the attack vector is network-based with low attack complexity, no privileges required, but user interaction is needed. The scope is changed, and the impact is high confidentiality loss without integrity or availability impact. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits have been reported.

An unauthorized attacker can disclose sensitive information over the network, potentially leading to confidentiality breaches. There is no impact on integrity or availability. The vulnerability affects the confidentiality of data handled by Azure Data Explorer.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Data Explorer as a cloud service. Users should ensure their Azure Data Explorer service is updated according to Microsoft's guidance in the vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21524. No additional action is required beyond applying the official fix.