CVE-2026-85891
7.5HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-200
Impact
Unauthenticated attackers can read sensitive cluster information remotely across the network. They need network connectivity to the Azure HDInsight service endpoints.
Root cause
An information disclosure flaw exposes sensitive internal data to unauthorized network requests.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Check the Microsoft Security Response Center advisory for cluster runtime updates, and restrict network access to HDInsight clusters using Azure Network Security Groups or private endpoints until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.