This vulnerability (CVE-2026-23659) in Microsoft Azure Data Factory involves the exposure of sensitive information to unauthorized actors over a network. It is categorized under CWE-200, indicating an information disclosure flaw. The CVSS 3.1 base score is 8.6, with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, meaning the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in a high confidentiality impact and scope change. The vulnerability affects the cloud service Azure Data Factory. Microsoft has released an official fix and manages remediation on their cloud platform. No known exploits are reported in the wild at this time.

An attacker can remotely disclose highly sensitive information from Azure Data Factory without requiring authentication or user interaction. This confidentiality breach could expose critical data managed within the service. There is no impact on integrity or availability. The scope is changed, indicating the vulnerability affects resources beyond the initially vulnerable component.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Data Factory as a cloud service. Customers should ensure their Azure Data Factory instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23659. No additional action is required beyond applying the official fix.