ZeroHour

CVE-2026-62906

Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio

CVSS 3.1
7.4 high
EPSS
<1%p50
Published
()
Modified
AI analysis

CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.

What to do: Apply the Microsoft September 2026 Patch Tuesday security updates for Discovery Studio as soon as possible and verify your inventory for deployments of the product, including which users have access. Because exploitation requires user interaction, advise users to avoid clicking unexpected links or submitting unsolicited input while patching is in progress, and monitor Microsoft's advisory for any expanded guidance.

Affected
Microsoft Discovery Studio
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.

Weakness
CWE-943
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

In the news

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

The September 2026 Security Update Review

ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.

The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.