Azure HDInsight: Information disclosure vulnerability

Summary

Microsoft Azure HDInsight, a managed cloud service for open-source big-data frameworks, contains an information disclosure vulnerability (CWE-200). An unauthorized attacker with network access can obtain sensitive information without authentication or user interaction. Microsoft does not state which data is exposed, and the CVSS vector indicates a confidentiality impact only.

Affected

• Microsoft Azure HDInsight: versions 1.0 up to but not including build 2606012120

Fixed in

• Build 2606012120 and later, according to the sibling advisory CVE-2026-81349. Whether this CVE requires the same fix must be verified in the MSRC advisory.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no.
• Microsoft CVSS vector includes E:U (exploit code maturity unproven).
• No public proof of concept found.

Our recommendation

• Identify any HDInsight clusters in your Azure tenant.
• Check whether the cluster image build is at least 2606012120.
• Follow the MSRC guidance on recreating affected clusters if it applies.
• Review cluster network exposure and access controls.
• Consider this issue low priority unless you actively run HDInsight.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85891 msrc.microsoft.com
• Microsoft advisory CVE-2026-81349 (sibling HDInsight advisory) msrc.microsoft.com
• OpenCVE: CVE-2026-85891 app.opencve.io
• Strix: CVE-2026-85891 www.strix.ai
• Rapid7: October 2026 Patch Tuesday www.rapid7.com
• Orca Security: Azure HDInsight vulnerabilities orca.security

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:33.