CVE-2026-32173 is an improper authentication vulnerability (CWE-287) in the Azure SRE Agent Gateway's SignalR Hub component. Due to insufficient authentication controls, an attacker without privileges can disclose sensitive information over the network. The vulnerability affects the cloud-hosted Azure service, which Microsoft manages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity or availability impact, with an official fix available.

An unauthorized attacker can exploit this vulnerability to disclose sensitive information from the Azure SRE Agent Gateway SignalR Hub over the network. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32173 for details. No additional action is required beyond ensuring the service is updated and patched as per Microsoft's guidance.