This vulnerability (CWE-923) in Azure IoT Explorer involves improper restriction of communication channels, enabling unauthorized information disclosure over the network. It affects version 1.0.0 of the product. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and a high impact on confidentiality. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

An attacker can disclose sensitive information over the network without authentication or user interaction, potentially compromising confidentiality of data handled by Azure IoT Explorer. There is no impact on integrity or availability reported. No known exploits in the wild have been observed.

An official fix is available from Microsoft. Since Azure IoT Explorer is a cloud service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23664 for detailed guidance and ensure their service instances are updated accordingly.