CVE-2026-48567
An authentication bypass flaw in Azure HorizonDB lets attackers impersonate legitimate users and gain elevated privileges over a network. The vulnerability can be exploited without any user interaction or special permissions.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure HorizonDB – the database service used by organizations to store and manage data in Azure.
Real-world impact
An attacker who exploits this flaw can take control of the HorizonDB instance, read, modify, or delete data, and potentially move laterally within the network.
Why this severity
The CVSS score of 10 reflects that the flaw can be triggered over the network (AV:N), requires no authentication (PR:N), and gives attackers full control (I:H, A:H). The attack is simple (AC:L) and does not need user interaction (UI:N).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory