CVE-2022-26897
Published: 15 April 2022
Summary
CVE-2022-26897 is a medium-severity an unspecified weakness vulnerability in Microsoft Azure Site Recovery. Its CVSS base score is 4.9 (Medium).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-26897 is an information disclosure vulnerability affecting Azure Site Recovery. It carries a CVSS 3.1 base score of 4.9 with the vector string AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating a network-reachable flaw that can expose sensitive data when specific conditions are met.
An attacker with high privileges can exploit the weakness remotely without user interaction to obtain confidential information from the affected Azure component. The unchanged scope rating means any data exposure remains confined to the vulnerable resource itself.
Microsoft security advisories published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26897 provide official guidance on available patches and mitigation steps for the issue.
The associated EPSS score has remained flat at a peak and current value of 0.0665 since disclosure, with no material upward trajectory observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31444
Vulnerability details
Azure Site Recovery Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.