What is the CVSS score of CVE-2026-66803?

CVE-2026-66803 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Azure Cosmos DB are affected by CVE-2026-66803?

A critical authentication bypass in Microsoft Azure Cosmos DB enables unauthenticated remote code execution against your database infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-66803?

Immediately inventory all Azure Cosmos DB instances in your Azure environment and restrict network access to these resources where operationally feasible (within 24 hours). Coordinate with Microsoft to obtain and deploy the vendor patch to all affected Cosmos DB deployments; prioritize production systems for remediation within 7 days. Verify patch deployment across your entire Azure footprint, review access logs for suspicious activity during the exposure period, and confirm all instances are running the patched version no later than 30 days from detection.

Azure Cosmos DB CVE-2026-66803

EUVD-2026-51302 CRITICAL

Improper Access Control (CWE-284)

2026-07-30 microsoft

GHSA-ww36-75qc-rhmx

Authentication Bypass Microsoft Azure Cosmos Db

10.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable access-control bypass needing no privileges or interaction yields AV:N/AC:L/PR:N/UI:N; managed multi-tenant service crossing a trust boundary gives S:C with full C:H/I:H/A:H from code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:15 vuln.today

CVE Published

Jul 30, 2026 - 20:28 cve.org

CRITICAL 10.0

DescriptionCVE.org

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Azure Cosmos DB allows an unauthorized, unauthenticated attacker to execute code over a network by abusing an improper access control (authentication bypass) flaw. Microsoft rates it CVSS 10.0 with a scope change, meaning a successful attack against the managed database service can impact resources beyond the initially vulnerable component. No public exploit has been identified at time of analysis (CVSS exploit maturity is Unproven), and it is not on the CISA KEV list, but the maximum severity and network-reachable, no-privilege profile make it a top-priority fix.

Technical ContextAI

Azure Cosmos DB is Microsoft's globally distributed, multi-model NoSQL/PaaS database service, meaning the affected component is Microsoft-operated cloud infrastructure rather than customer-installed software (CPE cpe:2.3:a:microsoft:azure_cosmos_db). The root cause is CWE-284 (Improper Access Control) - the service failed to correctly enforce authorization boundaries, which the vendor tags describe as an Authentication Bypass. In a shared multi-tenant PaaS context, an access-control failure of this class can let a request reach code paths or data it should never be authorized for, and combined with the CVSS scope change (S:C) it implies the trust boundary between the vulnerable component and other resources (e.g., other tenants or the control plane) can be crossed.

RemediationAI

Patch available per vendor advisory: because Azure Cosmos DB is a Microsoft-operated PaaS, the fix is deployed server-side by Microsoft and typically requires no customer patching action - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66803 to confirm whether any customer-side configuration change or SDK/client update is required. As compensating and defense-in-depth measures while confirming, restrict Cosmos DB account network exposure by enabling private endpoints / VNet service endpoints and IP firewall rules to limit which networks can reach the account, disable key-based access in favor of Microsoft Entra ID (Azure AD) RBAC where possible, rotate account keys, and review Cosmos DB diagnostic logs and Azure Monitor for anomalous data-plane access; note that tightening network rules or disabling key auth can break existing application connectivity and should be validated in staging first.