CVE-2026-23664
Published: 10 March 2026
Summary
CVE-2026-23664 is a high-severity Improper Restriction of Communication Channel to Intended Endpoints (CWE-923) vulnerability in Microsoft Azure Iot Explorer. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Authorizing wireless access restricts the wireless communication channel to only intended endpoints.
Approving specific exchanges and documenting interface characteristics restricts communication channels to only intended endpoints and systems.
Limits physical connectivity to transmission channels, supporting restriction of communication paths to only intended endpoints.
Requiring providers to meet communication-channel restrictions and monitoring adherence reduces improper restriction of channels to intended endpoints.
Mandates restriction of the channel for authentication to only the intended trusted endpoints, blocking unauthorized communication paths.
Explicit control of VoIP traffic forces organizations to restrict communication channels to only intended endpoints and protocols.
Explicit internal/external separation restricts name-resolution channels to their intended communication endpoints.
Enforces that the wireless communication channel is usable only by intended endpoints, addressing improper channel restriction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network info disclosure vuln in Azure IoT Explorer enables exploitation of public-facing apps (T1190) to obtain sensitive data from the system (T1005).
NVD Description
Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
Deeper analysisAI
CVE-2026-23664 is an information disclosure vulnerability in Azure IoT Explorer stemming from improper restriction of communication channel to intended endpoints, mapped to CWE-923. Published on 2026-03-10T18:18:14.523, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no effects on integrity or availability.
An unauthorized attacker can exploit this vulnerability remotely over a network with low attack complexity, requiring no privileges or user interaction. Exploitation enables the disclosure of sensitive information via unintended communication channels.
Microsoft's Security Response Center provides an update guide for mitigation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23664.
Details
- CWE(s)