What is the CVSS score of CVE-2026-33109?

CVE-2026-33109 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Managed Instance for Apache Cassandra are affected by CVE-2026-33109?

Azure Managed Instance for Apache Cassandra contains a critical remote code execution vulnerability (CVE-2026-33109, CVSS 9.9) that allows low-privileged authenticated users to escape tenant…. A patch is available.

How to fix or mitigate CVE-2026-33109?

Within 24 hours: identify all Azure subscriptions running Managed Instance for Apache Cassandra and document current versions. Within 7 days: apply the vendor-released patch to all affected instances; coordinate with Microsoft for deployment windows and validate patch application across all clusters. Within 30 days: conduct access control audit of Cassandra instances to identify and revoke any unauthorized low-privilege accounts that may have been exploited during the vulnerability window.

Azure Managed Instance for Apache Cassandra CVE-2026-33109

EUVD-2026-28448 CRITICAL

Improper Access Control (CWE-284)

2026-05-07 microsoft

GHSA-g4xx-6vv3-3x48

Authentication Bypass Microsoft Apache

9.9

CVSS 3.1 · NVD

Temporal: 8.6

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

8.6 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 22:01 vuln.today

CVE Published

May 07, 2026 - 20:58 nvd

CRITICAL 9.9

DescriptionCVE.org

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

Articles & Coverage 1

blog.talosintelligence.com Microsoft May 2026 Patch Tuesday: 31 Critical RCE Vulnerabilities Including Windows, Office, Azure May 12, 2026

AnalysisAI

Remote code execution in Azure Managed Instance for Apache Cassandra allows authenticated attackers with low privileges to execute arbitrary code across tenant boundaries. The vulnerability involves improper access control (CWE-284) enabling scope escape with complete compromise of confidentiality, integrity, and availability. Microsoft has released a patch per MSRC advisory. CVSS 9.9 (Critical) reflects network-based attack with low complexity, low privileges required, and changed scope indicating container/tenant escape potential.

Technical ContextAI

Azure Managed Instance for Apache Cassandra is Microsoft's fully managed cloud service for Apache Cassandra databases, providing automated deployment, scaling, and maintenance. The vulnerability stems from CWE-284 (Improper Access Control), a broad weakness class covering insufficient authorization checks, privilege validation failures, or security boundary enforcement gaps. In multi-tenant cloud environments like Azure, access control flaws can enable lateral movement between customer instances or privilege escalation from database user to underlying infrastructure. The Changed Scope (S:C) in the CVSS vector indicates the vulnerability affects resources beyond the vulnerable component's authorization scope, suggesting potential container escape, cross-tenant access, or cloud infrastructure compromise. Tags reference 'Authentication Bypass' alongside 'Apache' and 'Microsoft', indicating the flaw may allow circumventing authentication boundaries in the Cassandra service layer or Azure management plane.

RemediationAI

Apply vendor-released patch per Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33109. As a fully managed Azure service, patching is typically performed by Microsoft through service updates rather than customer-initiated upgrades - consult the MSRC advisory for service update timeline and any required customer actions. Until patching is complete, implement compensating controls: restrict network access to Azure Managed Cassandra instances using Azure Network Security Groups or Private Endpoints to trusted IP ranges only, eliminating public internet exposure (mitigates AV:N attack vector but impacts legitimate remote access). Review and minimize privileged user accounts with Cassandra database access, enforcing principle of least privilege and multi-factor authentication for all accounts (reduces PR:L attack surface but requires operational overhead). Audit access logs for unauthorized code execution attempts or unusual cross-tenant activity patterns. Enable Azure Defender for Cloud alerts on Cassandra instances to detect exploitation indicators.