This vulnerability in Microsoft Cost Management involves the exposure of sensitive information to unauthorized actors via network access. It is identified as CWE-200, indicating information disclosure. The CVSS v3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has published an official fix for this issue, and the vendor advisory is available for detailed remediation guidance. The product is not a cloud service, so remediation depends on applying the patch.

An unauthorized attacker can disclose sensitive information over a network without requiring privileges or user interaction. The confidentiality impact is high, but integrity and availability are not affected. This could lead to leakage of sensitive data managed by Microsoft Cost Management.

Apply the official fix provided by Microsoft as detailed in their security update advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47633). Since this is not a cloud service, patching the affected installations is necessary to remediate the vulnerability. There are no known exploits in the wild, but timely patching is recommended to prevent potential exploitation.