Azure Cosmos DB Elevation of Privilege Vulnerability
CVE-2026-87701 is an elevation of privilege vulnerability in Azure Cosmos DB (rated Critical, CVSS 9.6). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2026-87701- Products
- Azure Cosmos DB
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2026-Sep
- Assigned by
- Microsoft
- Weakness
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- MSRC revision
- 1.0
- Status pages
- Azure Cosmos DB status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-09-17:
Information published.
Microsoft says
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over…
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure Cosmos DB
- Public Preview: vCore-based Azure Cosmos DB for MongoDB cross-region disaster recovery (DR) · In preview
- Public preview: Partition merge now supports shared throughput databases · In preview
- Public Preview: Mirroring Azure Cosmos DB in Microsoft Fabric · In preview
- Public preview: Microsoft Copilot for Azure capability now available in Azure Cosmos DB · In preview
- Public preview: Dynamic scaling per partition and per region · In preview
- Public preview: Priority-based execution in Azure Cosmos DB · In preview
- Generally Available: DiskANN in Azure Cosmos DB for NoSQL · Launched
- Public preview: Filtered vector search in vCore-based Azure Cosmos DB for MongoDB · In preview
Last updated