What is the CVSS score of CVE-2026-26145?

CVE-2026-26145 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Azure Synapse are affected by CVE-2026-26145?

Microsoft Azure Synapse Analytics contains a critical privilege escalation flaw (CVE-2026-26145, CVSS 9.8) that enables authenticated users to escalate their access beyond their assigned permissions.. A patch is available.

How to fix or mitigate CVE-2026-26145?

Within 24 hours: Identify all Synapse Analytics deployments and classify by data sensitivity; alert affected teams that a critical patch is available. Within 7 days: Coordinate with Azure administrators to apply Microsoft's latest security update through your deployment channel (Azure Portal, Infrastructure-as-Code, or patch management tool); refer to Microsoft's Security Update Guide for version details and rollback procedures. Within 30 days: Complete deployment verification, review recent access logs for unauthorized privilege escalation activity, and perform access control audit to ensure least-privilege principles remain enforced.

Azure Synapse CVE-2026-26145

EUVD-2026-41444 CRITICAL

Improper Access Control (CWE-284)

2026-07-02 microsoft

GHSA-g6fh-wh88-hxp9

Authentication Bypass Microsoft Azure Synapse

Critical

Disputed · 9.8 NVD

Temporal: 4.3

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.3 MEDIUM

cvss

vuln.today AI

8.8 HIGH

Description states an 'authorized attacker,' so PR:L rather than PR:N; network vector and low complexity retained, with total technical impact giving C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 07, 2026 - 14:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 07, 2026 - 14:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 07, 2026 - 14:37 vuln.today

cvss_changed

Severity Changed

Jul 07, 2026 - 14:37 NVD

MEDIUM CRITICAL

CVSS changed

Jul 07, 2026 - 14:37 NVD

4.8 (MEDIUM) 9.8 (CRITICAL)

Analysis Generated

Jul 02, 2026 - 22:52 vuln.today

DescriptionNVD

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Azure Synapse Analytics allows a network-based, authorized attacker to bypass improper access controls and gain higher privileges than assigned. The flaw carries a critical 9.8 CVSS with full confidentiality, integrity, and availability impact, though its EPSS probability is modest (0.33%, 24th percentile) and CISA SSVC records no observed exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a fix through its Security Update Guide.

Technical ContextAI

Azure Synapse Analytics is Microsoft's cloud-based enterprise analytics service that unifies data warehousing, big-data (Spark) processing, and data-integration pipelines within the Azure platform. The root cause is classified as CWE-284 (Improper Access Control), meaning the service fails to properly enforce authorization boundaries so that an already-authenticated identity can perform actions or reach resources beyond its intended permission set. Because Synapse is a multi-tenant managed cloud service, an access-control weakness in its authorization layer can affect the isolation between workspace roles, users, or tenants. The single CPE provided (cpe:2.3:a:microsoft:azure_synapse:*) is version-agnostic, consistent with a continuously-updated cloud service rather than a discretely versioned on-premises product.

RemediationAI

Because Azure Synapse is a Microsoft-managed cloud service, remediation is primarily service-side: Microsoft reports a patch is available per the Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26145), and customers should confirm their workspaces are running the updated service and apply any customer-actionable steps Microsoft specifies there. No exact fix version applies given the SaaS delivery model. As compensating controls while validating the fix, restrict Synapse workspace access using Azure RBAC least-privilege role assignments, enforce network isolation via Managed Virtual Network and private endpoints to limit the network attack surface implied by AV:N, disable public network access to the workspace where feasible, and audit workspace/role assignments and Synapse activity logs for anomalous privilege changes. Tightening network access may break connectivity for integration runtimes or external clients, so validate data-pipeline dependencies before enforcing isolation.