CVE-2022-26896
Published: 15 April 2022
Summary
CVE-2022-26896 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-26896 is an information disclosure vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 base score of 4.9 and is characterized by network attack vector, low attack complexity, and a requirement for high privileges, resulting in high confidentiality impact without affecting integrity or availability.
An authenticated attacker with administrative access can exploit the issue remotely to obtain sensitive information from the affected Azure Site Recovery deployment. The vulnerability does not require user interaction and leaves the security scope unchanged.
Microsoft Security Response Center advisories for CVE-2022-26896 provide guidance on available updates and configuration changes to address the exposure. The associated EPSS score has remained flat at a peak of 0.0644 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31443
Vulnerability details
Azure Site Recovery Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.