Azure Database for PostgreSQL CVE-2026-85878

Requires a valid, low-privileged authenticated identity with existing access to Azure Database for PostgreSQL (PR:L) - for example a limited database role or a scoped Azure RBAC/subscription principal; it is NOT exploitable by fully unauthenticated internet attackers. Given AV:N/AC:L/UI:N, once that foothold exists no user interaction and no special client conditions are needed, and it works over the network against the managed service. Limiting factors: the authentication prerequisite (attacker must already hold some legitimate access to the service or tenant) and the fact that the fix is applied server-side by Microsoft, so environments patched by the vendor are no longer exposed.

This is a high-priority issue on paper: the vendor (Microsoft) CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, driven by low attack complexity, no user interaction, a scope change (S:C), and total confidentiality/integrity/availability impact - consistent with an authorization flaw letting a low-privileged, already-authenticated tenant escape its authorization boundary in a multi-tenant managed database. However, several severity-tempering and confidence signals must be stated explicitly: PR:L means this is NOT unauthenticated - an attacker needs valid low-level access (e.g., a legitimate database/subscription foothold), which the 9.9 headline obscures. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable mass-exploitation; treat this as a targeted, credential-gated risk rather than an internet-wide worm-class threat. As an Azure cloud service, the flaw is remediated server-side by Microsoft with no customer patch, CPE, or affected-version data - reducing customer action but also meaning the fix cannot be independently verified. Note also a taxonomy conflict: the 'Authentication Bypass' tag conflicts with CWE-285 (improper authorization) - this is an authorization-boundary escape, not an authentication bypass.

A tenant with a legitimate but low-privileged foothold on Azure Database for PostgreSQL (e.g., a limited database role or a low-privilege subscription/RBAC identity) sends crafted requests that the service authorizes incorrectly, granting access or actions beyond the attacker's assigned scope. Because the scope changes (S:C), the escalation reaches resources or a control plane outside the attacker's original authorization boundary, potentially exposing or modifying other tenants' data. No public exploit code is identified at time of analysis, and exploitation requires pre-existing authenticated access.