CVE-2026-21528: medium-severity vulnerability in Microsoft Azure IoT Explorer
Azure IoT Explorer Information Disclosure Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Azure IoT Explorer binds to all network addresses without restriction, allowing anyone on the network to access sensitive information. This can expose details about IoT devices and configurations that should remain private.
The application binds to an unrestricted IP address (0.0.0.0 or ::), permitting unauthenticated remote attackers to access exposed endpoints and retrieve sensitive information disclosure over the network. No authentication is required when the service is accessible on the network, increasing the attack surface in shared network environments.
In the same product, most dangerous first.