CVE-2026-26122

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26122", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-02-11T15:52:13.911Z", "datePublished": "2026-03-05T22:18:22.492Z", "dateUpdated": "2026-06-19T18:17:56.355Z"}, "containers": {"cna": {"title": "Microsoft ACI Confidential Containers Information Disclosure Vulnerability", "datePublic": "2026-03-05T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft_aci_confidential_containers:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft ACI Confidential Containers", "versions": [{"version": "-", "status": "affected"}]}], "descriptions": [{"value": "Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-1188: Initialization of a Resource with an Insecure Default", "lang": "en-US", "type": "CWE", "cweId": "CWE-1188"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:17:56.355Z"}, "references": [{"name": "Microsoft ACI Confidential Containers Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}], "tags": ["exclusively-hosted-service"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T20:26:58.642440Z", "id": "CVE-2026-26122", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:27:09.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26122", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:26:58.642440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:27:03.149Z"}}], "cna": {"tags": ["exclusively-hosted-service"], "title": "Microsoft ACI Confidential Containers Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft ACI Confidential Containers", "versions": [{"status": "affected", "version": "-"}]}], "datePublic": "2026-03-05T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122", "name": "Microsoft ACI Confidential Containers Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Initialization of a Resource with an Insecure Default"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:microsoft_aci_confidential_containers:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "-"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-06-19T18:17:56.355Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26122", "state": "PUBLISHED", "dateUpdated": "2026-06-19T18:17:56.355Z", "dateReserved": "2026-02-11T15:52:13.911Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-03-05T22:18:22.492Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft ACI Confidential Containers", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "-"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:aci_confidential_containers:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0672AA1-25ED-4836-A487-6DA0FC873C84", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "secure@microsoft.com", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network."}, {"lang": "es", "value": "Vulnerabilidad de revelaci\u00f3n de informaci\u00f3n de Contenedores Confidenciales de Microsoft ACI"}], "id": "CVE-2026-26122", "lastModified": "2026-06-17T10:25:45.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26122", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:26:58.642440Z", "version": "2.0.3"}}]}, "published": "2026-03-05T23:16:19.843", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft ACI Confidential Containers", "source": "cna", "vendor": "Microsoft"}, "product": "microsoft_aci_confidential_containers", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T15:10:16.971024+00:00", "value": {"mitigation_remediation": ["Apply the latest Microsoft update for Azure Container Instance Confidential Containers as published on the Microsoft Security Update Guide", "Restrict network access to the confidential container resources to only trusted IP ranges or isolate them within a secure subnet", "Review and revise the container initialization settings to remove insecure defaults and enforce least\u2011privilege principles"], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Microsoft\u2019s Azure Container Instance confidential container service is affected. Microsoft ACI Confidential Containers in Azure Compute Gallery is the product identified. No specific version numbers are disclosed in the available data.", "description_and_impact": "A configuration error in Azure Compute Gallery causes a resource to be initialized with an insecure default, letting an authorized attacker read sensitive data over the network. The flaw results in the accidental exposure of confidential information and is classified as CWE\u20111188. No arbitrary code execution or denial of service is possible from the description.", "risk_and_exploitability": "The vulnerability has a CVSS base score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, implying a very low probability of exploitation. It is not listed in the CISA KEV catalog. Even though the attack requires an authenticated user with authorization to the resource, the low exploitation probability suggests limited risk if proper access controls are in place. Administrators should consider the impact of potential data leakage when evaluating the criticality of the affected container configuration."}}}}, "created": "2026-03-06T14:56:40.318397+00:00", "updated": "2026-04-15T17:00:07.046206+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$microsoft_aci_confidential_containers"]}