CVE-2026-45642

FAQ

How do I protect myself from this vulnerability?

Microsoft has already deployed a service-side fix for this vulnerability in Azure Attestation. No customer patching or update installation is required.

To ensure you remain protected, follow the guidance below:

• Use the latest supported attestation policy

  • No action is required if you are already using the current recommended policy version (1.2) for Azure Attestation.

• Do not rely on certain attestation events for security decisions

  • Customers should not use the following events for security assertions in attestation policies:

These events can no longer be considered trustworthy signals for attestation evaluation.

Adjust existing policies if needed

• If your current attestation policy relies on these events for security enforcement, update it to remove them.
• You may still reference these events for diagnostic or informational purposes only, but they should not be used to make trust decisions.

Continue monitoring via supported claims

• If needed, the above events are still available in the allEvents claim.
• However, Microsoft does not guarantee the integrity or trustworthiness of data within these events.