Azure SQL Database CVE-2026-63522

Exploitation requires an existing low-privileged local OS account on the host running Azure SQL Database - the CVSS PR:L metric confirms this. No network-level access is needed; the attack is entirely local (AV:L). No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no special timing, race conditions, or configuration state beyond having local access is needed. Exploitation is limited by the requirement for prior local authentication: remote unauthenticated attackers cannot directly exploit this flaw. The specific resource with incorrect permissions is not identified in available data, which limits the ability to assess whether default installations or only specific configurations are vulnerable.

The CVSS 3.1 score of 7.8 (High) is well-supported by the vector: local access with low privileges and no user interaction required, resulting in full C/H/I/A impact. The attack complexity is low, meaning no race conditions or special timing are needed once local access is obtained. EPSS data was not provided in this intelligence package, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC is publicly known, which meaningfully reduces immediate urgency compared to remotely exploitable or actively exploited issues. That said, the local privilege escalation profile maps well to post-compromise lateral movement scenarios - even a mid-sized municipal IT team in sopot should treat this as urgent within their patch cycle if they operate Azure SQL workloads on shared or multi-tenant infrastructure. The tags indicate potential for information disclosure beyond privilege escalation, warranting review of what data the elevated permissions expose. The absence of a confirmed fix version from the MSRC reference is a gap that prevents precise remediation scoping.

An attacker who has already obtained a low-privilege local OS account on a Windows host running Azure SQL Database - for example, via phishing, a compromised service account, or lateral movement - identifies an overly permissive resource (file, named pipe, or registry key) associated with the SQL engine. By writing to or replacing that resource, the attacker manipulates the database engine's behavior to execute code or access data at an elevated privilege level, achieving full control over the database instance.