CVE-2026-69454: Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability
Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability
Other sources
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9376Patch KB5126651
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems using Microsoft Azure Attestation service or Microsoft Device Health Attestation Service are identified as affected. Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025 are also listed as affected software.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact if exploited?
The vulnerability is an out-of-bounds read that can allow an unauthorized attacker to disclose information over a network. The supplied metrics indicate high confidentiality impact, with no integrity or availability impact.