CVE-2026-69577: Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability
Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability
Other sources
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9376Patch KB5126651 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability can be exploited remotely over a network by an unauthorized attacker. It does not require prior privileges or user interaction.
What is the expected impact if exploitation succeeds?
Successful exploitation may allow disclosure of information through an out-of-bounds read. The available data does not indicate an integrity or availability impact.
Which systems should be prioritized for review?
Review deployments running Microsoft Windows Server 2019, Windows Server 2022, or Windows Server 2025 that use Microsoft Azure Attestation service or Device Health Attestation Service.