Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-87701: Azure Cosmos DB allows authorized users to gain higher privileges
CVE-2026-87701 · published 11 days ago
Summary
A flaw in Azure Cosmos DB’s handling of certain data can let a user who is already signed in increase their access rights across the network, potentially seeing or changing data they shouldn't. This could expose sensitive information or disrupt operations. Apply Microsoft’s latest updates for Cosmos DB and review your user permission settings to ensure only needed privileges are granted.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | azure cosmos db | - |
Original advisory text
Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87701 vendor-advisory patch
Severity
9.6
Critical
CVSS 3.1: 9.6 (NVD)
Exploitation
EPSS <1%
Type
CWE-74Injection
Timeline
Published17 Sep 2026
Updated27 Sep 2026
First seen17 Sep 2026
Track software like this
Free during beta