CVE-2026-68789
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authorized attacker can exploit SQL injection to manipulate the database, potentially leading to privilege escalation and data integrity compromise.
Recommendation
Apply patches from Microsoft for Azure SQL Database and review SQL queries for vulnerabilities.
Other vulnerabilities in Azure SQL Database
See all- CVE-2026-69502Critical
Server-Side Request Forgery (SSRF) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-68782Critical
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- CVE-2026-66309Critical
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
- CVE-2026-56162Critical
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-63522High
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS