Microsoft Azure Confidential Clean Room: Missing authorization allows tampering
Summary
A missing authorization check in Microsoft Azure Confidential Clean Room allows an authorized, low-privileged user to tamper with data over the network. The CNA rates the impact as high integrity with no confidentiality or availability impact, and the attack requires a valid account in the affected service. The product is a managed preview service for multiparty data collaboration, so exposure is limited to organisations that take part in such clean rooms.
Affected
- Microsoft Azure Confidential Clean Room from 1.0.0 before 11.0.0
- CVSS 3.1 base score 7.7 (CNA score), vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- CWE-862 (Missing Authorization)
Fixed in
- Version 11.0.0 is the first fixed version according to the affected range; not yet confirmed by the vendor advisory.
Workaround
Unknown.
Exploitation
- No public proof of concept known.
- Exploitation rated as less likely by Rapid7; not listed in CISA KEV according to a secondary mirror (not checked directly).
- CNA exploit maturity: unproven (E:U).
Our recommendation
- If you have no Azure Confidential Clean Rooms deployment, no action is needed.
- If you use the service, check the deployed version against the Microsoft Security Update Guide advisory and apply any update Microsoft specifies.
- Review which accounts have clean-room access and remove unneeded permissions.
- Monitor clean-room activity for unexpected changes to data or results.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-121668 msrc.microsoft.com
- CVE Record CVE-2026-121668 www.cve.org
- Rapid7: Patch Tuesday November 2026 (EM) www.rapid7.com
- Azure Confidential Clean Rooms documentation learn.microsoft.com
- Multiparty data collaboration with Azure Confidential Computing learn.microsoft.com
- STRIX CVE data mirror: CVE-2026-121668 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:47.
Original description (NVD)
Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.