Azure Synapse CVE-2026-26145

The description specifies an 'authorized attacker' elevating privileges over a network, so the concrete prerequisite is possession of an existing authorized/authenticated identity with network reachability to the Azure Synapse service - this directly contradicts the CVSS PR:N and indicates at least low-privilege authentication is required in practice. What limits exploitation: the attacker must already have some legitimate access to (or a foothold reachable to) the targeted Synapse workspace, no public exploit exists, CISA SSVC records the exploit as not automatable and no observed exploitation, and EPSS is low (0.33%). No specific non-default configuration is named in the source data as a requirement.

The signals are notably in tension and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, all-High impact) yields a critical 9.8 implying trivial unauthenticated network exploitation, yet the description explicitly states an 'authorized attacker' elevates privileges - a contradiction, since PR:N denotes no privileges required. This discrepancy suggests the true prerequisite is a low-privileged but authenticated Synapse identity, making the effective vector closer to PR:L; verify with the vendor advisory. Countervailing signals lower real-world urgency: EPSS is only 0.33% (24th percentile), CISA SSVC reports Exploitation: none and Automatable: no, and no POC is known - so this is a high-CVSS issue without evidence of imminent mass exploitation. However, SSVC Technical Impact is 'total,' matching the all-High CVSS impact, so a successful exploit is genuinely severe. Net: patch promptly given the cloud attack surface and total impact, but this is not currently an actively-exploited emergency.

An attacker holding a low-privilege authorized identity within (or reachable to) an Azure Synapse workspace sends crafted requests over the network that exploit the missing authorization check, causing the service to grant actions beyond the attacker's assigned role. Leveraging the low attack complexity, the attacker escalates to a higher-privileged context and gains total control over the affected data and processing resources. No public proof-of-concept is known, so exploitation would require original research against the service.