The vulnerability identified as CVE-2026-65806 in Microsoft Azure CycleCloud 8.9.2 is classified under CWE-862 (Missing Authorization). It permits an attacker who is authorized but with limited privileges to access information that should be restricted, leading to information disclosure over a network. The CVSS v3.1 base score is 6.5, reflecting a medium severity impact with high confidentiality impact but no integrity or availability impact. The vulnerability affects the cloud service version 8.9.2. Microsoft has published an official fix and manages remediation for this cloud service, as detailed in their security update guide.

An authorized attacker with limited privileges can exploit this vulnerability to disclose sensitive information over the network. The confidentiality impact is high, but there is no impact on integrity or availability. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure CycleCloud cloud service. Users should refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65806 for detailed remediation instructions and ensure their Azure CycleCloud service is updated accordingly.