The vulnerability allows an unauthorized actor to obtain sensitive data from an Azure HDInsight cluster by querying the system over the network. The disclosed information could include configuration details or other confidential data, leading to confidentiality loss for the affected organization. The weakness is classified as CWE-200, an information exposure flaw.

Microsoft Azure HDInsight clusters are impacted. No specific version or patch level is listed, so all currently deployed clusters may be vulnerable until further product information is released by Microsoft.

The CVSS score of 7.5 indicates a high severity level. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented active exploitation as of the last update. The attack likely occurs over the network, with a remote attacker capable of accessing the HDInsight endpoint. Inference: the vulnerability is accessed via standard network channels, implying remote exploitation is feasible if no proper network segmentation or firewall rules are in place.