Azure Synapse CVE-2026-48584

Patch available per vendor advisory: Microsoft reports a fix is available, and because Azure Synapse is a Microsoft-managed cloud service the correction is typically deployed server-side by Microsoft rather than installed by customers - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48584 to confirm whether any customer-side action (e.g., updating self-hosted integration runtimes, Spark/SQL pool runtime versions, or workspace configurations) is required for full mitigation. As compensating controls, apply least-privilege rigorously to Synapse workspace roles and managed identities (restrict Synapse Administrator/Contributor assignments and audit RBAC), enforce Azure Entra Conditional Access and just-in-time/PIM elevation for privileged Synapse roles to shrink the pool of low-privileged accounts that could trigger the flaw, and restrict workspace network exposure via managed virtual networks, private endpoints, and IP firewall rules to limit which authorized identities can reach the service (trade-off: tightening network and RBAC scope can disrupt legitimate pipelines and integration runtime connectivity, so stage changes carefully).