This vulnerability (CVE-2026-26122) involves the initialization of a resource with an insecure default configuration in the Azure Compute Gallery component of Microsoft ACI Confidential Containers. An authorized attacker could exploit this to disclose sensitive information over the network. The vulnerability has been assigned a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and resulting in high confidentiality impact without integrity or availability impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service.

An authorized attacker can disclose sensitive information over the network due to insecure default initialization of a resource. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Microsoft has provided an official fix for this vulnerability. As this is a cloud service, Microsoft manages the remediation server-side. Users should consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122 for confirmation and ensure their service is updated accordingly.