This vulnerability (CVE-2026-48567) in Microsoft Azure HorizonDB involves an authentication bypass by spoofing, classified under CWE-290. It enables an attacker without privileges to elevate their access over a network, potentially compromising the integrity and availability of the service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high impact on integrity and availability. Microsoft manages remediation for this cloud-hosted service and has released an official fix as per their advisory.

An attacker can bypass authentication mechanisms in Azure HorizonDB, allowing unauthorized privilege escalation. This can lead to significant integrity and availability impacts on the service. Confidentiality impact is not indicated. No active exploitation has been reported.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure HorizonDB as a cloud service. Users should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567 to ensure their service instances are updated and protected.