CVE-2026-45642: Microsoft Azure Attestation improper input validation spoofing vulnerability

CVE-2026-45642 · Severity: low · CVSS 3.9 · Published 2026-06-09

A vulnerability in Microsoft's Azure and Device Health Attestation services could allow an attacker with physical access to a device to spoof its security health status. These services are used to verify that a computer's hardware and software are in a trusted state before allowing access to sensitive corporate resources. While the risk is low because it requires physical access and high-level administrative privileges, a successful exploit could allow a compromised device to appear secure to the network.

Technologies: Microsoft Azure Attestation, Microsoft Device Health Attestation Service. Vendors: Microsoft.

Quick answers

Is CVE-2026-45642 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45642 being exploited in the wild.
How severe is CVE-2026-45642?
Low severity, with a CVSS score of 3.9, published 9 June 2026.
Which products and versions are affected?
Microsoft Azure Attestation; Microsoft Device Health Attestation Service.
Is there a fix for CVE-2026-45642?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45642 attacked?
It is attacked with physical access, in a hosted service.
Am I affected by CVE-2026-45642?
Check whether you run Microsoft Azure Attestation or Microsoft Device Health Attestation Service. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability (CWE-20) exists in the Microsoft Azure Attestation and Device Health Attestation services. The flaw allows an attacker to perform spoofing by providing crafted input that the services fail to properly validate. To exploit this, an attacker must have physical access to the target hardware and possess high-level administrative privileges (PR:H). Successful exploitation allows the attacker to bypass integrity checks, potentially misrepresenting the security posture of the device to attestation providers. Microsoft has addressed this issue in their June 2026 security updates.

Affected products

  • Microsoft Azure Attestation
  • Microsoft Device Health Attestation Service

Timeline

  • 2026-06-09: disclosed: Initial publication by Microsoft and NVD.
  • 2026-06-09: advisory: Microsoft released security update guide for CVE-2026-45642.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.