CVE-2026-69454: Microsoft Azure Attestation service and Device Health Attestation Service Information Disclosure Vulnerability
Overview
- Severity
- High (CVSS 7.5)
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- Category
- Information Disclosure
- Exploit Status
- Not Exploited
- Exploitation Likelihood
- Less Likely
- Patch Tuesday
- 2026-Oct
- Released
- 2026-10-13
Description
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
FAQ
What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read portions of process memory.
What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server.
Affected Products (6)
Windows
- Windows Server 2019
- Windows Server 2019 (Server Core installation)
- Windows Server 2022
- Windows Server 2022 (Server Core installation)
- Windows Server 2025 (Server Core installation)
- Windows Server 2025
Security Updates (3)
Acknowledgments
41ae55e9310ff27fa6f26af4727e5590
Revision History
- 2026-10-13: Information published.