CVE-2026-62835
An attacker can exploit a flaw in Azure Portal that lets them read sensitive data without any authentication. The vulnerability is severe because it can be triggered from anywhere on the internet and requires no special skills or user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Azure Portal – the web interface used to manage Microsoft Azure services. No specific product versions are listed in the data.
Real-world impact
An attacker could read confidential information that is exposed through the portal, potentially revealing account details, configuration data, or other sensitive information.
Why this severity
The CVSS score of 9.3 reflects a network‑based attack that requires no privileges, no user interaction, and can compromise confidentiality at a high level while only slightly affecting availability. The low attack complexity and lack of required privileges make it easy for attackers to exploit.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 24, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory