First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-23661

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Azure IoT Explorer	>= 1.0.0, < 0.15.13

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23661Patch, Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-236627.5Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-236637.5Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.CVE-2026-236647.5Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose inform CVE-2026-236657.8Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally.CVE-2026-236667.5Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-236677.0Use after free in Broadcast DVR allows an authorized attacker to elevate privileges locally.CVE-2026-236687.0Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an author CVE-2026-236698.8Use after free in RPC Runtime allows an authorized attacker to execute code over a network.CVE-2026-23676.4The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'a CVE-2026-236705.7Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feat CVE-2026-236717.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allow CVE-2026-236727.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

CVE-2026-23661: High severity, CVSS 7.5 | Vulnix