Skip to main content

Azure Sql Database

5 CVEs product

Monthly

CVE-2026-68782 CRITICAL PATCH Exploit Unlikely Act Now

Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.

SQLi Microsoft Azure Sql Database
NVD VulDB
CVSS 3.1
9.9
EPSS
0.5%
CVE-2026-66309 CRITICAL PATCH Act Now

Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.

Authentication Bypass Microsoft Azure Sql Database
NVD VulDB
CVSS 3.1
9.1
EPSS
0.5%
CVE-2026-68789 CRITICAL PATCH Exploit Unlikely Act Now

Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

SQLi Microsoft Azure Sql Database
NVD
CVSS 3.1
9.9
EPSS
0.5%
CVE-2026-63522 HIGH NEWS This Week

Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.

Information Disclosure Microsoft Azure Sql Database
NVD VulDB
CVSS 3.1
7.8
EPSS
0.3%
CVE-2026-56162 CRITICAL NEWS HOSTED Monitor

Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.

Microsoft Authentication Bypass Azure Sql Database
NVD VulDB
CVSS 3.1
10.0
EPSS
0.5%
EPSS 1% CVSS 9.9
CRITICAL PATCH Exploit Unlikely Act Now

Privilege elevation via SQL injection (CWE-89) affects Microsoft Azure SQL Database, where an already-authorized attacker can inject unneutralized special elements into SQL commands over the network to gain higher privileges than granted. The 9.9 CVSS score reflects a scope change (S:C) with high confidentiality, integrity, and availability impact, meaning a low-privileged database principal could break out of its authorization boundary. Microsoft has released a fix, and there is no public exploit identified at time of analysis.

SQLi Microsoft Azure Sql Database
NVD VulDB
EPSS 0% CVSS 9.1
CRITICAL PATCH Act Now

Privilege elevation in Microsoft Azure SQL Database lets an already-authenticated, high-privileged principal escalate its permissions over the network through an improper access-control check (CWE-284). The CVSS scope change (S:C) indicates the abuse crosses an intended trust boundary within the managed service, threatening confidentiality, integrity, and availability. No public exploit identified at time of analysis and the flaw is not in CISA KEV; Microsoft has addressed it server-side per its MSRC advisory.

Authentication Bypass Microsoft Azure Sql Database
NVD VulDB
EPSS 1% CVSS 9.9
CRITICAL PATCH Exploit Unlikely Act Now

Privilege escalation in Microsoft Azure SQL Database allows an already-authenticated, low-privileged attacker to inject crafted SQL over the network and gain elevated database privileges. Rated CVSS 9.9 with a scope-changing vector, the flaw stems from improper neutralization of special elements in SQL commands (CWE-89); Microsoft has issued a service-side fix. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

SQLi Microsoft Azure Sql Database
NVD
EPSS 0% CVSS 7.8
HIGH This Week

Privilege escalation in Azure SQL Database allows a locally authenticated attacker to gain elevated permissions through incorrect permission assignment on a critical resource. The flaw is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning a resource - likely a file, registry key, named pipe, or shared object - is accessible with overly permissive settings. An attacker with existing local access and low-privilege credentials could exploit this to achieve high confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.

Information Disclosure Microsoft Azure Sql Database
NVD VulDB
EPSS 0% CVSS 10.0
CRITICAL HOSTED Monitor

Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.

Microsoft Authentication Bypass Azure Sql Database
NVD VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy