CVE-2026-32173
Published: 03 April 2026
Summary
CVE-2026-32173 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Azure Sre Agent. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-32173 is an improper authentication vulnerability affecting the Azure SRE Agent. Published on April 3, 2026, it enables an unauthorized attacker to disclose information over a network and is linked to CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization). The issue carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low attack complexity, and lack of prerequisites.
Any unauthorized attacker can exploit this vulnerability remotely over the network without privileges, user interaction, or special conditions. Exploitation allows the attacker to achieve high-impact information disclosure, with a changed scope that amplifies the confidentiality breach while leaving integrity and availability unaffected.
The Microsoft Security Response Center provides guidance on this vulnerability, including mitigation and patch details, at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32173.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18558
Vulnerability details
Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authentication (CWE-287) in network-accessible Azure SRE Agent directly enables remote unauthenticated information disclosure (CVSS AV:N/AC:L/PR:N), matching T1190 exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to uniquely identify and authenticate services like the Azure SRE Agent, directly mitigating improper authentication that enables unauthorized network access.
Enforces approved access control policies to block unauthorized logical access and information disclosure over the network.
Authorizes and secures remote access methods to the Azure SRE Agent, preventing network-based exploitation by unauthorized attackers.