EUVD-2026-82591
GHSA-h2ch-prcm-fxx9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network injection by an already-authorized actor sets PR:L and AC:L; scope change (S:C) reflects impact on a downstream component, with high confidentiality/integrity and no availability impact per the description.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Azure Cosmos DB allows an attacker who already holds valid low-level authorization to a Cosmos DB account or service to exploit an injection flaw (CWE-74) and reach a downstream component with improperly neutralized special elements, escalating privileges over the network. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) - network-reachable, low complexity, no user interaction, but gated behind existing authorization, with a scope change (S:C) driving the Critical rating despite the absence of an availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold valid low-level authorization to the target Azure Cosmos DB service or account (PR:L) - this is not an unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects a network-reachable injection flaw (CWE-74) in Azure Cosmos DB that an already-authorized attacker can leverage to elevate privileges, with a scope change (S:C) driving the Critical rating despite A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No customer-installable patch or fixed service version is identified in the supplied data; this is a Microsoft-managed cloud service, so the primary remediation is Microsoft's server-side fix applied to the Azure Cosmos DB backend, and customers cannot close the issue by upgrading a package. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, treat CVE-2026-87701 as an active risk-management item: inventory every Azure Cosmos DB account in the tenant, record which identities (users, service principals, managed identities, connection strings) hold keys or data-plane roles, and confirm that no account is reachable from the public internet without firewall or private-endpoint restrictions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full comprom
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privile
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today