Loading vulnerability…
Azure Cosmos DB Injection Privilege Escalation
CVE-2026-87701 is a critical elevation-of-privilege vulnerability in Azure Cosmos DB. The flaw is caused by improper neutralization of special elements in output consumed by a downstream component, enabling injection. An authorized attacker can exploit the vulnerability remotely over a network to elevate privileges. The issue is rated CVSS 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N and affects an exclusively hosted service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged authorized attacker to obtain elevated privileges in Azure Cosmos DB. The vulnerability has high confidentiality and integrity impact, including potential access to sensitive data and unauthorized modification of resources or data. No availability impact is identified.
If you can’t patch tonight, do this now.
No customer mitigation is required because the vulnerability has been fully mitigated by Microsoft in the cloud service. Organizations should nevertheless maintain least-privilege access controls and review privileged Cosmos DB activity for anomalous access or modifications.
Patch, then assume compromise.
No customer-applied update or patch is required. Microsoft has fully remediated the vulnerability in the Azure Cosmos DB hosted service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.