This vulnerability, identified as CWE-287 (Improper Authentication), exists in the Azure SRE Agent Gateway - SignalR Hub component. It allows unauthorized attackers to bypass authentication controls and disclose sensitive information over the network. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with scope changed. Microsoft has published an official fix and manages the remediation for this cloud service.

An attacker can exploit this vulnerability remotely without authentication or user interaction to disclose sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability affects the security posture of the Azure SRE Agent Gateway service by allowing unauthorized information disclosure.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure SRE Agent Gateway as a cloud service. Users of the service should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32173 for detailed guidance. No additional user action is required beyond applying the official fix as managed by Microsoft.