Microsoft has disclosed a critical injection vulnerability in Azure Cosmos DB, rated CVSS 9.6, that lets an authorized attacker escalate privileges over a network and break out of the original security scope.
What Is It
CVE-2026-87701 is an improper neutralization of special elements in output used by a downstream component, an injection flaw (CWE-74), in Azure Cosmos DB. Per Microsoft's description, the weakness "allows an authorized attacker to elevate privileges over a network."
The CVSS 3.1 base score is 9.6 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The exploitability subscore is 3.1 and the impact subscore is 5.8. The record was published 2026-09-17 by Microsoft ([email protected]) and currently carries NVD status "Received."
Why It Matters
The metrics describe a low bar to abuse and a high payoff. Attack vector is network, attack complexity is low, no user interaction is required, and the attacker needs only low privileges; which suggests that an authorized identity with network reach to the service could serve as a starting point, though Microsoft has not published the specific privileges or access path required.
The scope metric is Changed, indicating impact extends beyond the vulnerable component's own security authority. Combined with high confidentiality and high integrity impact, that would be consistent with unauthorized data access and modification beyond the attacker's original boundary, though Microsoft has not detailed what the crossed boundary is in practice. Availability impact is rated None.
Neither Microsoft's advisory nor the NVD record indicates active exploitation at this time.
What's Vulnerable
Microsoft lists a single affected product: Azure Cosmos DB, with version recorded as "-" (affected). No specific version ranges or CPE entries are provided.
Microsoft has tagged the CVE exclusively-hosted-service. That tag denotes a vulnerability in a service Microsoft operates, rather than in software customers install and run themselves.
Patch Status
Microsoft's MSRC advisory lists no customer-facing patch, update, or required action. Because the issue is tagged as an exclusively hosted service, remediation is handled on the service side rather than through a customer-applied update.
Defenders should consult the MSRC update guide entry below for the authoritative status and any customer guidance Microsoft issues.
Sources
- Microsoft Security Response Center (MSRC) Update Guide; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87701
- NVD, CVE-2026-87701, https://nvd.nist.gov/vuln/detail/CVE-2026-87701