CVE-2026-26147 is an improper input validation vulnerability (CWE-20) in the Azure Compute Gallery component of Microsoft Azure Stack HCI. An attacker with authorized access can exploit this flaw to disclose sensitive information over the network. The vulnerability has a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26147.

The vulnerability allows an authorized attacker to disclose sensitive information over the network, potentially exposing confidential data within Azure Stack HCI environments. There is no impact on data integrity or availability. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. As Azure Stack HCI is a cloud service, Microsoft manages the remediation server-side. Users should consult the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26147 to confirm that their environment has been updated. No additional user action is required beyond ensuring the service is up to date.