Microsoft disclosed CVE-2026-62835, a critical improper-authorization vulnerability in Azure Portal that lets an unauthenticated attacker disclose sensitive information over a network.
What Is It
CVE-2026-62835 is an improper authorization weakness (CWE-285) in Microsoft's Azure Portal. According to the NVD record, the flaw "allows an unauthorized attacker to disclose information over a network." It carries a CVSS 3.1 base score of 9.3 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. In plain terms, the attack is remote, low-complexity, requires no privileges and no user interaction, and crosses a security scope boundary (S:C). Impact is concentrated on confidentiality (High), with a low availability impact and no integrity impact. The CVE was published July 24, 2026, and is tagged by Microsoft as an "exclusively-hosted-service."
Why It Matters
The combination of no required privileges, no user interaction, network reach, and a changed scope is what pushes this to a 9.3. An attacker does not need an account or a foothold to attempt exploitation, and the scope change means the impact can extend beyond the initially vulnerable component. The primary risk is disclosure of high-value confidential information managed through the Azure Portal.
What's Vulnerable
- Vendor: Microsoft
- Product: Azure Portal (listed affected version:
-)
Because Azure Portal is an exclusively hosted service, the affected surface is Microsoft's cloud-hosted platform rather than customer-installed software.
Patch Status
As of this writing, the NVD entry is in "Awaiting Analysis" status. The vulnerability is documented in Microsoft's Security Response Center (MSRC) update guide, which is the authoritative source for remediation details. Given that Azure Portal is a Microsoft-hosted service, mitigation is typically applied by Microsoft on the service side. The supplied source material does not include a CISA KEV entry, so there is no confirmation of active exploitation and no CISA-mandated required action at this time. Administrators should consult the MSRC advisory for the latest guidance.