CVE-2026-26145

MediumCVSS 4.8

Published: 02/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. The vulnerability affects authorization mechanisms in Microsoft's analytics service.

Risk Assessment

An authorized attacker could gain higher privileges than intended, potentially taking control over resources or data in the Azure Synapse environment.

Recommendation

Apply security updates provided by Microsoft for Azure Synapse. Audit access control configurations and restrict trusted accounts to the minimum necessary.

Other vulnerabilities in Azure Synapse

CVE-2026-48584Critical
A vulnerability in Azure Synapse allows execution with unnecessary privileges. An authorized attacker can remotely elevate privileges over a network.

Original NVD description (English source)

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS