CVE-2026-48567: Azure HorizonDB Elevation of Privilege Vulnerability

Synopsis

Authentication bypass by spoofing in Azure HorizonDB allows an unauthenticated remote attacker to elevate privileges without any user interaction. The vulnerability is reachable over the network, requires no prior credentials, and carries a CVSS 10.0 critical score with a changed scope, meaning exploitation can affect components beyond HorizonDB itself. Successful exploitation gives the attacker the ability to tamper with data and disrupt service availability at high severity. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Microsoft publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Azure HorizonDB service over a network; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerability is exploitable by an entirely unauthenticated attacker.

• Victim interactionNot required

  No user action, click, or social-engineering step is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker gains elevated privileges within HorizonDB without holding any prior account, bypassing all normal access controls.
• Due to the changed scope (S:C), the attacker can affect components and data stores outside HorizonDB itself, not just the directly targeted service.
• Integrity impact is high: the attacker can modify, overwrite, or delete persisted data managed by HorizonDB.
• Availability impact is high: the attacker can crash or render the HorizonDB service unresponsive, disrupting dependent workloads.