This vulnerability (CVE-2026-26147) in Microsoft Azure Stack HCI arises from improper input validation in the Azure Compute Gallery, enabling an authorized attacker to disclose information over a network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

An authorized attacker can exploit this vulnerability to disclose sensitive information over the network, potentially compromising confidentiality. There is no impact on integrity or availability. The vulnerability affects the Azure Compute Gallery component within Azure Stack HCI.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Stack HCI as a cloud service. Users should ensure their Azure Stack HCI environments are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26147. No additional user action is required beyond applying the official fix.