CVE-2026-66309
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
Risk Assessment
Risk of unauthorized access to data and administrative operations in the database.
Recommendation
Apply security updates provided by Microsoft and review access control configurations.
Other vulnerabilities in Azure SQL Database
See all- CVE-2026-69502Critical
Server-Side Request Forgery (SSRF) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-68789Critical
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- CVE-2026-68782Critical
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- CVE-2026-56162Critical
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-63522High
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS