CVE-2026-45642: Microsoft Azure Attestation Auth Bypass

CVE-2026-45642 Overview

CVE-2026-45642 is an improper input validation vulnerability [CWE-20] affecting Microsoft Azure Attestation service and Device Health Attestation Service. An authorized attacker with physical access to a target device can leverage the flaw to perform spoofing against the attestation pipeline. The vulnerability does not directly disclose confidentiality or affect availability, but it allows integrity tampering against attestation evidence.

Microsoft published the advisory on June 9, 2026. The flaw carries a CVSS 3.1 score of 3.9 and the attack vector requires physical proximity, which constrains real-world exploitation to scenarios such as device theft, supply chain interception, or insider misuse.

Critical Impact
An authorized attacker with physical access can spoof attestation results, undermining trust decisions made by services that rely on Azure Attestation or Device Health Attestation outputs.

Affected Products

Microsoft Azure Attestation service
Microsoft Device Health Attestation Service

Discovery Timeline

2026-06-09 - CVE-2026-45642 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45642

Vulnerability Analysis

The vulnerability resides in how the Microsoft Azure Attestation service and the Device Health Attestation Service validate input submitted as part of the attestation workflow. Both services produce signed claims that downstream systems consume to make trust and access decisions about a device's integrity state. When input is improperly validated, an attacker can submit crafted attestation evidence that the service accepts as legitimate.

The primary impact is spoofing. An attacker can cause the attestation infrastructure to issue or accept claims that misrepresent a device's true state. Systems relying on these claims may treat a tampered or unauthorized device as healthy.

Root Cause

The root cause is improper input validation [CWE-20] in the attestation request handling logic. The services do not enforce sufficient checks on attestation evidence supplied during the verification flow, allowing malformed or manipulated input to pass validation.

Attack Vector

Exploitation requires physical access to a target device along with high privileges. No user interaction is needed. The attacker manipulates locally generated attestation inputs, such as TPM-bound measurements or quote structures, and submits them through the standard attestation flow. The integrity impact is high, while confidentiality and availability are not affected.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.106%.

Detection Methods for CVE-2026-45642

Indicators of Compromise

Attestation evidence submissions originating from devices with mismatched hardware identifiers or inconsistent TPM measurement logs.
Unexpected attestation success events for devices previously flagged as non-compliant or out of policy.
Repeated attestation requests from the same device with subtly varied payload structures.

Detection Strategies

Correlate Azure Attestation and Device Health Attestation service logs with endpoint inventory and configuration baselines to surface devices whose attested state diverges from observed telemetry.
Alert on attestation results that conflict with other signals such as Microsoft Defender for Endpoint device health, Intune compliance, or conditional access decisions.
Monitor for attestation requests received outside expected hours, geographies, or network segments for managed devices.

Monitoring Recommendations

Forward attestation service logs to a centralized analytics platform and retain them for forensic review.
Track changes to TPM ownership state, secure boot configuration, and measured boot logs across the fleet.
Establish baselines for normal attestation volume per device and alert on anomalies that may indicate replay or spoofing attempts.

How to Mitigate CVE-2026-45642

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-45642 Update Guide as soon as it is available for affected services.
Inventory systems and workflows that consume Azure Attestation or Device Health Attestation claims and validate that downstream trust decisions include defense-in-depth signals.
Restrict physical access to high-value endpoints, particularly those holding privileged credentials or used by administrators.

Patch Information

Microsoft addresses this vulnerability through service-side updates to the Azure Attestation service and Device Health Attestation Service. Refer to the Microsoft CVE-2026-45642 Update Guide for the authoritative remediation status and any required client-side updates.

Workarounds

Combine attestation results with additional conditional access signals such as device compliance, user risk, and sign-in risk before granting sensitive access.
Enforce BitLocker, secure boot, and tamper protection to raise the cost of physical attacks against endpoints.
Limit which accounts hold the high privileges required to interact with attestation flows and apply just-in-time elevation where possible.

bash

# Example: require compliant and hybrid-joined device signals in addition to attestation
# (Conditional Access policy concept — configure via Microsoft Entra admin center)
Require: deviceCompliance = true
Require: hybridAzureADJoined = true
Require: signInRiskLevel <= low