The vulnerability in Azure Data Factory permits an unauthorized actor to expose sensitive information over a network connection, compromising data confidentiality. It is classified as a CWE‑200 flaw in which information may be disclosed to unintended recipients.

Microsoft Azure Data Factory is affected. No specific version numbers are listed in the public data, so all current deployments should be assessed.

The CVSS score of 8.6 indicates high severity, but EPSS of less than 1% shows low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation would occur via a remote network attack against the data factory interfaces, typically requiring authenticated or anonymous access to the service's API endpoints.