EUVD-2026-54311
GHSA-jgfq-jqm8-rpfv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Remote, unauthenticated, low-complexity channel/auth bypass in a multi-tenant service crossing an isolation boundary (S:C) with high C/I but no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Azure SQL Managed Instance lets an unauthenticated network attacker cross the intended communication-channel boundary and gain elevated privileges, carrying a scope-changed CVSS of 10.0 that reflects likely cross-tenant or cross-service impact in this multi-tenant PaaS offering. Microsoft tags it as an authentication bypass exposing high-value confidentiality and integrity, with no availability loss. There is no public exploit identified at time of analysis and EPSS probability is low (0.36%, 29th percentile), consistent with a vendor-discovered, service-side issue rather than mass exploitation.
Technical ContextAI
Azure SQL Managed Instance is Microsoft's fully managed, multi-tenant PaaS deployment of the SQL Server engine, running inside a customer virtual network but atop shared Azure control-plane and networking infrastructure. The flaw is CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints): the service failed to constrain a network channel to only its intended, authenticated endpoints, accepting trust or traffic from an endpoint that should have been unreachable or rejected. In a multi-tenant database service this class of weakness typically manifests as one tenant, or an unauthenticated party, reaching a management or data endpoint meant to be isolated, thereby escalating privileges. The affected CPE is cpe:2.3:a:microsoft:azure_sql_managed_instance, a service offering with no discrete on-premises version, so the boundary logic is enforced entirely in Microsoft-operated infrastructure.
RemediationAI
Because Azure SQL Managed Instance is a Microsoft-operated PaaS, remediation is a service-side fix delivered by the vendor and generally requires no customer action - Patch available per vendor advisory (MSRC) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62836; no exact customer-installable fix version applies to a cloud service. Confirm your instances run current service builds and review the MSRC guidance for any customer-facing steps or confirmation of automatic mitigation. As defense-in-depth that reduces exposure to network-channel weaknesses, restrict the Managed Instance to private endpoints only and disable the public data endpoint if enabled (trade-off: breaks direct internet connectivity for clients that depend on it), lock inbound network security group rules to known application subnets (trade-off: requires maintaining an allowlist), and enforce Microsoft Entra authentication with conditional access; audit sign-in and firewall logs for anomalous cross-tenant or unexpected-endpoint access.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today