Azure SQL Database EUVD-2026-63994

Per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N, exploitation requires only network access to the affected Azure SQL Database service with no authentication and no user interaction, and low attack complexity - i.e., no special tenant configuration is stated as a prerequisite in the available data. The concrete requirement is the ability to reach an Azure SQL Database endpoint and supply input that the service forwards as a server-side request (CWE-918). Limiting factors that reduce real-world exposure: this is a Microsoft-hosted service, so the exploitable surface and any fix are controlled by Microsoft rather than the customer, and organizations that front their SQL logical servers with Private Link/private endpoints or restrictive firewall rules reduce the attacker's network reachability. The input provides no version, CPE, EPSS, or KEV data, so no configuration-specific limiting condition beyond network reachability can be confirmed.

This is a genuine top-priority issue on the raw signals: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N describes remote, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact and a scope change, producing the maximum 10.0 score. Working against that urgency, there is no EPSS score, no SSVC decision data, no KEV listing, and no POC in the provided intelligence, so exploitation is currently 'no public exploit identified at time of analysis' rather than confirmed active abuse - the 10.0 reflects potential impact, not observed exploitation. A mitigating real-world factor unique to this case is that Azure SQL Database is a Microsoft-operated cloud service, so remediation is applied by Microsoft server-side and most customers do not need to act; conversely, because the service is multi-tenant, a successful SSRF-to-privilege-escalation could have cross-tenant consequences, which is why even a mid-sized operator relying on Azure SQL should treat it as urgent until Microsoft confirms the fix is deployed. The A:N (no availability impact) slightly tempers the profile, but C:H/I:H with a scope change keeps this firmly in the critical tier.

A remote attacker with no credentials sends crafted input to an internet-reachable Azure SQL Database interface that causes the service to make a server-side request on the attacker's behalf toward an internal endpoint (for example a cloud metadata or management-plane address). Because the request originates from the trusted service context and crosses a trust boundary (S:C), the attacker obtains elevated privileges or sensitive internal data. No POC is present in the provided data, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:N) and the CWE-918 SSRF classification rather than a published exploit.