Microsoft has disclosed CVE-2026-56162, a maximum-severity (CVSS 10.0) improper authentication flaw in Azure SQL Database that lets an unauthenticated remote attacker elevate privileges over the network.
What Is It
CVE-2026-56162 is an improper authentication vulnerability (CWE-287) in Azure SQL Database. Per Microsoft's description, the flaw "allows an unauthorized attacker to elevate privileges over a network." The NVD record for the CVE currently carries a vulnerability status of "Received," meaning NVD analysis is still pending.
Microsoft assigned a CVSS 3.1 base score of 10.0 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, exploitability subscore 3.9, impact subscore 6.0.
Why It Matters
The vector breaks down to a worst-case profile: network-reachable, low attack complexity, no privileges required, and no user interaction. A scope change (S:C) means successful exploitation affects resources beyond the vulnerable component's security authority, and all three impact metrics, confidentiality, integrity, and availability, are rated HIGH. That combination is what produces a perfect 10.0.
CVE-2026-56162 does not appear in the CISA Known Exploited Vulnerabilities catalog (linked below), so there is no confirmation of active exploitation in the wild at this time.
What's Vulnerable
Microsoft lists the affected product as Azure SQL Database, vendor Microsoft, with the version recorded as - (not version-scoped). No CPE entries are present in the NVD record.
Microsoft tagged this CVE exclusively-hosted-service in its MSRC Update Guide entry (linked below). That tag indicates the vulnerability exists in a service Microsoft hosts and operates directly.
Patch Status
The supplied source material contains no patch, build number, or customer-facing remediation instruction. Because the CVE is tagged exclusively-hosted-service, no version data or affected-build list is provided in the record. No required action or remediation deadline was supplied, and there is no KEV due date. Administrators should consult the MSRC update guide entry below for authoritative status.
Sources
- NVD, CVE-2026-56162: https://nvd.nist.gov/vuln/detail/CVE-2026-56162
- Microsoft MSRC Update Guide; CVE-2026-56162: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56162
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog