This vulnerability involves an authentication bypass by spoofing in Microsoft Azure HorizonDB, enabling an attacker without prior privileges to escalate their access rights remotely. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and a scope change. The vulnerability impacts the integrity and availability of the service but not confidentiality. Microsoft manages remediation for this cloud-hosted service and has released an official fix as documented in their security update guide.

An attacker can bypass authentication mechanisms in Azure HorizonDB, allowing privilege escalation over the network. This compromises the integrity and availability of the service, potentially enabling unauthorized actions or disruption. Confidential data confidentiality is not directly impacted according to the CVSS vector.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure HorizonDB as a cloud service. Users should follow the guidance in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567 to ensure their environment is protected.