CVE-2026-62906

Microsoft Discovery Studio Information Disclosure Vulnerability

Published Sep 3, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Description

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.

Analysis

Technical impact

An information disclosure vulnerability exists in Microsoft Discovery Studio due to improper neutralization of special elements in data query logic. The flaw allows an attacker who can send crafted query data to the system to exfiltrate sensitive configuration or internal data over the network. This weakness is classified as CWE-943 and can lead to confidentiality loss of secrets or system state.

Affected Systems

The vulnerability affects Microsoft Discovery Studio. No specific product version information is supplied, so all currently deployed instances of this software are potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS base score of 7.4 indicates a high severity risk. The EPSS value is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be remote over a network, as the disclosure occurs when unauthorized users send data queries. Yielding the attacker the ability to read returned data without authentication or authorization. Consequently, organizations should treat this as a significant risk until mitigated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Discovery Studio

affected

Version	Status	Constraints
`-`	affected	—

Configuration 1 [-]

cpe:2.3:a:microsoft:discovery_studio:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Microsoft

Microsoft Discovery Studio

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Microsoft Discovery Studio update that contains the issued fix.
If an update is not yet available, restrict inbound network access to the Discovery Studio service to trusted internal hosts only or place the service behind a firewall with strict rules.
Add input validation and sanitization layers to any interfaces that accept query data, ensuring special characters are escaped or rejected before being processed.

Generated by OpenCVE AI on September 4, 2026 at 00:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.922% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62906

History

Oct 14, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft discovery Studio
CPEs		cpe:2.3:a:microsoft:discovery_studio:-:::::::*
Vendors & Products		Microsoft discovery Studio

Sep 4, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 3, 2026 11:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
Title		Microsoft Discovery Studio Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft microsoft Discovery Studio
Weaknesses		CWE-943
CPEs		cpe:2.3:a:microsoft:microsoft_discovery_studio::::::::
Vendors & Products		Microsoft Microsoft microsoft Discovery Studio
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62906
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C'}`