CVE-2026-32173 is an improper authentication vulnerability (CWE-287) in the Azure SRE Agent Gateway - SignalR Hub, enabling unauthorized network-based information disclosure. The vulnerability has a CVSS 3.1 base score of 8.6 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality with a scope change. Microsoft has released an official fix and, as this is a cloud service, remediation is managed by Microsoft. The vendor advisory is available at the Microsoft Security Response Center.

An attacker without any privileges or user interaction can exploit this vulnerability remotely to disclose sensitive information from the Azure SRE Agent Gateway. The confidentiality impact is high, but integrity and availability are not affected. The scope of the impact extends beyond the vulnerable component.

Microsoft has provided an official fix for this vulnerability and manages remediation for the cloud-hosted Azure SRE Agent Gateway service. Customers should ensure their Azure services are up to date and monitor the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32173 for the latest remediation guidance. No additional customer action is typically required beyond applying updates or relying on Microsoft's managed patching.