CVE-2026-23661

High

Published: 10 March 2026

Published

10 March 2026

Modified

12 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0006 20.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-23661 is a high-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Microsoft Azure Iot Explorer. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 20.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Network Sniffing (T1040).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-3 Role-based Training

addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

CA-3 Information Exchange

addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

CM-13 Data Action Mapping

addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

CM-6 Configuration Settings

addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

MP-1 Policy and Procedures

addresses: CWE-319

Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.

PM-17 Protecting Controlled Unclassified Information on External Systems

addresses: CWE-319

Enforces safeguards against cleartext transmission of CUI when data leaves organizational boundaries to external systems.

SA-9 External System Services

addresses: CWE-319

Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels.

SC-12 Cryptographic Key Establishment and Management

addresses: CWE-319

Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material.

MITRE ATT&CK Enterprise TechniquesAI

T1040 Network Sniffing Credential Access

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

attack.mitre.org →

Why these techniques?

Cleartext transmission of sensitive data over the network directly enables passive interception via network sniffing.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.

Deeper analysisAI

CVE-2026-23661 is a vulnerability in Azure IoT Explorer involving the cleartext transmission of sensitive information, which allows an unauthorized attacker to disclose that information over a network. Published on 2026-03-10T18:18:14.210, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-319 (Cleartext Transmission of Sensitive Information).

The vulnerability can be exploited by any unauthorized attacker with network access, requiring low attack complexity, no privileges, and no user interaction. Successful exploitation results in high-impact disclosure of sensitive information transmitted in cleartext, with no effects on system integrity or availability.

Mitigation details are provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23661.