Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-85878: Azure Database for PostgreSQL lets attackers gain higher access
CVE-2026-85878 · published 9 days ago
Summary
A weakness in Azure Database for PostgreSQL could let a user who already has some rights increase their level of control over the database, even from a remote location. This could allow them to see, change, or delete data they should not be able to touch. Apply the latest updates from Microsoft and review who has access to the database to reduce the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | azure horizondb | - |
| microsoft | azure_horizondb |
All versions
cpe:2.3:a:microsoft:azure_horizondb:-:*:*:*:*:*:*:* |
Original advisory text
Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85878 vendor-advisory patch
Severity
9.9
Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-285Improper Authorization
Timeline
Published17 Sep 2026
Updated27 Sep 2026
First seen17 Sep 2026
Track software like this
Free during beta