CVE-2026-23659
Published: 19 March 2026
Summary
CVE-2026-23659 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Microsoft Azure Data Factory. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23659 is a vulnerability in Azure Data Factory that results in the exposure of sensitive information to an unauthorized actor over a network. Classified under CWE-200, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and significant confidentiality impact with a scope change.
An unauthorized attacker can exploit this vulnerability remotely without authentication or user involvement. Successful exploitation enables the disclosure of sensitive information, potentially compromising confidentiality across the affected scope in Azure Data Factory.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23659.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13177
Vulnerability details
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a high-severity, unauthenticated remote information disclosure in a public-facing Azure cloud service (Data Factory), directly enabling exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely identification, reporting, and remediation of flaws like CVE-2026-23659 in Azure Data Factory.
Monitors and controls network communications at boundaries to block unauthorized remote access exploiting the network-exposed vulnerability.
Specifically monitors for unauthorized disclosure of sensitive information over the network, enabling detection of exploitation of this CVE.