CVE-2026-48567 is a critical authentication bypass by spoofing (CVSS 10.0) in Microsoft Azure HorizonDB that lets an unauthorized attacker elevate privileges over a network. The record gives no version data. Read the Microsoft Security Response Center entry to learn whether any action is required on your side.
What's affected
Microsoft Azure HorizonDB. The record lists no versions or fixed builds, and the Microsoft page is a script driven app that did not load text for our review. Open the MSRC entry for CVE-2026-48567 for the authoritative status.
Azure HorizonDB is a managed cloud service. For many managed service CVEs Microsoft applies the fix on its side, but the record does not say that here, so confirm it in the MSRC entry instead of assuming.
How to check if you're exposed
Check whether your organization uses Azure HorizonDB at all: search your Azure subscriptions and infrastructure code for it.
Then read the MSRC entry for statements like fixed in the service, no customer action required, or steps to take. Record what it says in your tracker.
What to do now
- Confirm whether any team uses Azure HorizonDB.
- Read the MSRC entry for CVE-2026-48567 and note whether action is required of customers.
- If action is listed, follow it and record the date.
- Review who can reach the service over the network, and restrict access with private networking where possible.
- Check access logs and identity logs for unexpected authentication events.
Why it matters
The class is CWE-290, authentication bypass by spoofing. The system accepts something an attacker can fake as proof of identity. The vector marks no privileges and no user interaction, with changed scope and high integrity and availability impact, which is how it reaches the top score.
Without vendor detail we cannot say more about the mechanism, and we will not guess. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48567 is a handy place to follow later updates.
Quick check
Do I have to patch a managed Azure service?
Not necessarily. Read the MSRC entry, which states whether customers need to act.
Sources
Last reviewed: 19 October 2026.
