CVE-2026-87701

CriticalCVSS 9.6

Published: 17/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

Risk Assessment

An authenticated attacker could exploit this to escalate privileges, gaining access to resources or operations they should not be permitted to use.

Recommendation

Update Azure Cosmos DB to the latest version and review permission configuration and access policies.

Other vulnerabilities in Azure Cosmos DB

See all

CVE-2026-66803Critical
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-69857High
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.

Original NVD description (English source)

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.