CVE-2026-62836

high

Published 2026-08-07 · Modified 2026-08-07

Discuss on Community Propose mitigation

CVSS v3

8.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.7

Description

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

Predictions

Exploit likelihood

91%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Microsoft Security Response Center · View original ↗ · proprietary-no-redistribution

Full prose not cached — VIR stores only structured fields (affected/fixed versions, references) for this source. Click "View original" above for the vendor's full advisory.

Affected

Vendor	Product	Version
microsoft	Microsoft Teams
microsoft	Azure Active Directory
microsoft	Microsoft Power Apps
microsoft	Microsoft SharePoint Online
microsoft	Azure Logic Apps
microsoft	Microsoft Purview eDiscovery
microsoft	Azure SRE Agent
microsoft	Microsoft Planetary Computer Pro (GeoCatalog)
microsoft	Application Insights Profiler
microsoft	Microsoft Entra Provisioning Service
microsoft	Azure SQL Managed Instance
microsoft	Azure Service Bus
microsoft	Azure SQL Database
microsoft	Microsoft 365 Admin Center
microsoft	Azure Confidential Ledger

OS impact

Windows Affected 1 release

Version	Status	Fixed in
—	Affected	—

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62836

CWEs

CWE-923

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.