Microsoft disclosed a critical improper authorization flaw (CVSS 9.9) in Azure Database for PostgreSQL that lets an authorized, low-privileged attacker escalate privileges over the network and cross a security boundary into other components.
What Is It
CVE-2026-85878 is an improper authorization vulnerability (CWE-285) in Azure Database for PostgreSQL. Per Microsoft's description, it "allows an authorized attacker to elevate privileges over a network."
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, producing a base score of 9.9 (CRITICAL), an exploitability subscore of 3.1 and an impact subscore of 6.0. The attack is remote, requires low attack complexity, needs only low privileges, and requires no user interaction. Crucially, the scope is Changed, meaning successful exploitation affects resources beyond the vulnerable component itself, with high impact to confidentiality, integrity, and availability.
Why It Matters
The combination that drives the 9.9 score is the important part: network-reachable, trivially complex, no user interaction, and only low privileges required. In practice, any principal that can already authenticate at a low privilege level is positioned to attempt escalation, and the changed scope means the blast radius extends past the database instance.
Microsoft tagged the CVE as exclusively-hosted-service, and CVSS availability, integrity, and confidentiality impacts are all rated High.
What's Vulnerable
Microsoft lists the affected product as Azure HorizonDB, with the affected version recorded as - (no discrete version enumerated). No CPE entries are published in the NVD record. Because this is flagged as an exclusively hosted service, there is no customer-side version to inventory.
Patch Status
The CVE record was published 2026-09-18 and carries NVD vulnerability status Received, meaning it has not yet completed NVD analysis. The supplied source material contains no CISA KEV entry for CVE-2026-85878; there is no confirmation of active exploitation and no KEV-mandated required action or due date.
No patch details, mitigations, or remediation steps are present in the supplied data. The exclusively-hosted-service tag indicates the fix is applied by Microsoft on the service side rather than by customers. Consult the MSRC update guide below for authoritative remediation status.
Sources
- Microsoft Security Response Center (MSRC) Update Guide, CVE-2026-85878, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85878
- NVD CVE Record; CVE-2026-85878 (source identifier: [email protected], published 2026-09-18, status: Received)