The vulnerability resides in Azure Cost Management Interactive Experiences where sensitive information can be exposed to an unauthorized actor. The flaw allows an attacker to retrieve confidential data—such as cost, usage, and billing details—over a network connection. This type of weakness is classified as information exposure (CWE‑200).

The affected product is Microsoft Azure Cost Management. The CVE does not list specific affected versions, so all implementations that have not applied the recent Microsoft patch are potentially impacted.

The CVSS score of 7.5 indicates a high severity. The exact probability of exploitation is unknown because the EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, the attack vector is likely remote over a network with an unauthenticated or low‑privilege attacker able to trigger the disclosure. No known exploits have been reported to date.