The vulnerability is a type of information disclosure (CWE-200) in Microsoft Azure Functions. A flaw permits remote actors to access sensitive data that should remain confidential, potentially exposing configuration details, secrets, or other private information. The impact is a breach of confidentiality for affected deployments.

Microsoft Azure Functions is the product affected. No specific versions are listed, so all current Azure Functions deployments may be vulnerable until Microsoft releases a fix.

The CVSS score of 8.2 places the issue in the high severity range, while the EPSS score of less than 1% indicates a very low probability of public exploitation at this time. It is not listed in the CISA KEV catalog, which suggests no widespread known exploitation. Based on the description, it is inferred that the likely attack vector involves accessing publicly accessible Azure Function endpoints or management APIs. Until a vendor patch is available, the risk remains significant for any environment that stores or processes confidential data within Azure Functions.