What is the CVSS score of EUVD-2026-54323?

EUVD-2026-54323 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Azure SQL Database are affected by EUVD-2026-54323?

Microsoft Azure SQL Database contains a critical privilege escalation vulnerability (CVSS 10.0) allowing unauthenticated attackers to bypass authentication and gain elevated database access, with no…

How to fix or mitigate EUVD-2026-54323?

Within 24 hours, inventory all Azure SQL Database instances and enable detailed audit logging to track authentication attempts and privilege changes. Within 7 days, restrict network access using Azure SQL Database firewall rules and Network Security Groups to limit exposure to trusted IP ranges only, conduct a comprehensive log review for suspicious access patterns, and implement IP allowlisting on all instances. Within 30 days, monitor Microsoft security bulletins for confirmation of server-side patch deployment, verify remediation across all instances, and validate that no unauthorized privilege escalation occurred during the vulnerability window.

Azure SQL Database EUVD-2026-54323

| CVE-2026-56162 CRITICAL

Improper Authentication (CWE-287)

2026-08-07 secure@microsoft.com

GHSA-6gmq-p797-9x4m

Authentication Bypass Microsoft Azure Sql Database

10.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

10.0 CRITICAL

Improper authentication reachable over the network with no credentials or interaction and a cross-tenant scope change yields PR:N, AC:L, S:C, and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:31 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 10.0

DescriptionCVE.org

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.

Technical ContextAI

The affected component is Azure SQL Database, Microsoft's fully managed relational database Platform-as-a-Service (PaaS) built on the SQL Server engine and fronted by the Azure control plane and gateway authentication layer. The root cause is CWE-287 (Improper Authentication), meaning the service fails to correctly verify an actor's claimed identity - likely in a token, credential, or session-validation path within the multi-tenant authentication flow. The scope change (S:C) in the CVSS vector indicates the authentication defect in one security authority (the authentication/gateway boundary) grants control over resources managed by a different authority, consistent with a tenant- or authorization-boundary bypass in a shared cloud environment. No CPE strings were provided, which is expected for a cloud SaaS/PaaS offering that carries no versioned on-premises product identifier.

RemediationAI

Because Azure SQL Database is a fully managed service, the fix is deployed by Microsoft to the cloud fleet and generally requires no customer action; no customer-installable patch version was provided, so the applicable status is 'Patch available per vendor advisory' - confirm remediation state at the MSRC guide https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56162. As compensating controls while confirming vendor status, restrict database access with Azure SQL firewall rules and Private Link/VNet service endpoints to limit network reachability (trade-off: may break clients connecting from public IPs), enforce Microsoft Entra ID (Azure AD) authentication and disable or rotate SQL logins to reduce reliance on any single credential path, and enable Microsoft Defender for SQL and auditing to detect anomalous authentication and privilege changes (trade-off: added cost and log volume). Review sign-in and audit logs for unexpected privilege elevation predating the fix.