CVE-2026-62906: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in Microsoft Microsoft Discovery Studio

This vulnerability, identified as CWE-943, arises from improper neutralization of special elements in data query logic within Microsoft Discovery Studio. Exploitation can lead to unauthorized information disclosure over a network. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact with no integrity or availability impact. Microsoft has released an official fix for this issue.

An attacker without privileges can exploit this vulnerability remotely to disclose sensitive information from Microsoft Discovery Studio over the network. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Microsoft has provided an official fix for this vulnerability. Users should apply the vendor's patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62906 to remediate the issue.