EUVD-2026-82597
GHSA-9vgx-8238-xgwc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated low-privilege attacker (PR:L) over network with no interaction; improper authorization crosses tenant/authorization boundary (S:C) enabling full C/I/A impact in a multi-tenant DBaaS.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate privileges over the network, potentially achieving full control over database resources. With a critical CVSS score of 9.9 due to scope change and high impact, the flaw requires a valid low-privileged identity to exploit; no public exploit code has been identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid, low-privileged authenticated identity with existing access to Azure Database for PostgreSQL (PR:L) - for example a limited database role or a scoped Azure RBAC/subscription principal; it is NOT exploitable by fully unauthenticated internet attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-priority issue on paper: the vendor (Microsoft) CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, driven by low attack complexity, no user interaction, a scope change (S:C), and total confidentiality/integrity/availability impact - consistent with an authorization flaw letting a low-privileged, already-authenticated tenant escape its authorization boundary in a multi-tenant managed database. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Microsoft applies a server-side fix for Azure Database for PostgreSQL; ensure your instance is updated to the latest version per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85878). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Azure Database for PostgreSQL instances, review audit logs for privilege escalation attempts, restrict network access to trusted IP ranges, and enforce least privilege for database users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today