CVE-2026-62835: CWE-285: Improper Authorization in Microsoft Azure Portal
Affects Microsoft Azure PortalSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 61% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L/E:U/RL:O/RC:CWhat to do
AI-suggested
Microsoft has provided an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Azure Portal environment is updated according to Microsoft's guidance and monitor official advisories for confirmation of patch deployment.
Description
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Impact
An unauthorized attacker can exploit this vulnerability remotely without any privileges or user interaction to disclose sensitive information from the Azure Portal. The impact is primarily on confidentiality, potentially exposing sensitive data. There is no reported impact on integrity, and availability impact is low. No known exploits are currently observed in the wild.
Summary
This vulnerability (CVE-2026-62835) involves improper authorization in the Microsoft Azure Portal, enabling an attacker without privileges or user interaction to disclose sensitive information over the network. The flaw is classified under CWE-285 (Improper Authorization). The CVSS v3.1 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact. The vulnerability affects the Azure Portal cloud service, and Microsoft has released an official fix to remediate the issue.