CVE-2026-23655: Azure Compute Gallery Info Disclosure Flaw

CVE-2026-23655 Overview

CVE-2026-23655 is an information disclosure vulnerability in Microsoft Azure Compute Gallery caused by cleartext storage of sensitive information. This vulnerability allows an authorized attacker with low privileges to disclose sensitive information over a network. The flaw is classified under CWE-312 (Cleartext Storage of Sensitive Information), which represents a critical security weakness where applications store sensitive data without proper encryption or protection mechanisms.

Critical Impact

Authorized attackers can exploit this vulnerability to access and disclose sensitive information stored in cleartext within Azure Compute Gallery, potentially exposing confidential data across network boundaries.

Affected Products

• Microsoft Azure Compute Gallery

Discovery Timeline

• February 10, 2026 - CVE-2026-23655 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23655

Vulnerability Analysis

This vulnerability stems from improper handling of sensitive information within Azure Compute Gallery. The service stores certain sensitive data in cleartext format, making it accessible to authenticated users who should not have visibility into this information. The network-accessible nature of this flaw means that an attacker with valid credentials and low-level privileges can remotely extract confidential data without requiring any user interaction.

The vulnerability specifically impacts data confidentiality with high severity, while integrity and availability remain unaffected. This indicates that the primary risk involves unauthorized data exposure rather than modification or service disruption.

Root Cause

The root cause of CVE-2026-23655 is improper data protection practices within Azure Compute Gallery's storage mechanisms. Sensitive information that should be encrypted or otherwise protected is instead stored in cleartext format. This design flaw violates fundamental security principles regarding the protection of sensitive data at rest. When combined with insufficient access controls, authenticated users with minimal privileges can access data that should be restricted to higher-privileged accounts or encrypted entirely.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to have valid authentication credentials to the Azure environment. The exploitation process involves:

1. Authentication: The attacker authenticates to the Azure environment with low-privilege credentials
2. Access: The attacker accesses the Azure Compute Gallery service
3. Discovery: The attacker locates cleartext sensitive information within the gallery's storage
4. Exfiltration: The attacker extracts the unprotected sensitive data over the network

Since no user interaction is required and the attack complexity is low, an authenticated attacker can reliably exploit this vulnerability to access confidential information. The vulnerability does not allow privilege escalation to other components (unchanged scope), but the impact on confidentiality is considered high.

Detection Methods for CVE-2026-23655

Indicators of Compromise

• Unusual data access patterns in Azure Compute Gallery from low-privileged accounts
• Abnormal read operations or bulk data retrieval activities targeting gallery resources
• Access attempts to sensitive metadata or configuration data by accounts that typically don't require such access
• Authentication events followed by rapid enumeration of gallery assets

Detection Strategies

• Monitor Azure Activity Logs for suspicious read operations within Compute Gallery
• Implement Azure Security Center alerts for anomalous access patterns
• Configure Azure Monitor to track data exfiltration indicators such as large data transfers
• Review audit logs for access to gallery resources by accounts with minimal required privileges

Monitoring Recommendations

• Enable diagnostic logging for Azure Compute Gallery resources
• Configure alerts for unusual API call patterns or access from unexpected IP addresses
• Implement User and Entity Behavior Analytics (UEBA) to detect credential misuse
• Regularly audit access permissions and review which accounts have gallery access

How to Mitigate CVE-2026-23655

Immediate Actions Required

• Review Microsoft's official security guidance at the Microsoft Security Update Guide
• Audit Azure Compute Gallery access permissions and apply least-privilege principles
• Review recent access logs for any suspicious data retrieval activities
• Consider temporarily restricting access to sensitive gallery resources until patches are applied

Patch Information

Microsoft has released a security update addressing this vulnerability. Organizations should consult the Microsoft Security Update for CVE-2026-23655 for detailed patching instructions and affected version information. Apply all security updates through standard Azure service update mechanisms.

Workarounds

• Implement additional access restrictions using Azure Role-Based Access Control (RBAC) to limit who can access gallery resources
• Enable Azure Private Link for Compute Gallery to restrict network exposure
• Deploy Azure Policy to enforce encryption requirements and access auditing
• Segment sensitive workloads and apply network security groups to limit lateral movement

# Azure CLI commands to review and restrict gallery access
# List role assignments for Compute Gallery
az role assignment list --scope /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Compute/galleries/{gallery-name}

# Enable diagnostic logging for the gallery
az monitor diagnostic-settings create \
  --name "GalleryDiagnostics" \
  --resource "/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Compute/galleries/{gallery-name}" \
  --logs '[{"category": "AllLogs", "enabled": true}]' \
  --workspace "{log-analytics-workspace-id}"