This vulnerability (CWE-312) involves the cleartext storage of sensitive information in Microsoft ACI Confidential Containers, specifically within Azure Compute Gallery. An attacker with authorized access and network connectivity could potentially disclose sensitive data due to the lack of encryption at rest. The vulnerability affects version 1.0.0 of the product. Microsoft, as the vendor of this cloud-hosted service, has released an official fix and manages remediation server-side. The CVSS score of 6.5 reflects a medium severity with high confidentiality impact but no integrity or availability impact.

An authorized attacker with network access can disclose sensitive information stored in cleartext, potentially leading to confidentiality breaches. There is no impact on integrity or availability. No known exploits are currently reported in the wild.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should ensure their Microsoft ACI Confidential Containers environment is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23655. No additional mitigation actions are required beyond applying the official fix.