🟠 High | Source: Microsoft Security Response Center
A vulnerability in Azure SQL Database allows an authenticated attacker to exploit incorrect permission assignments to elevate their privileges within the service. Because the attack is local and requires existing authorisation, the risk is highest in multi-tenant or shared environments where users may have limited but legitimate access. If exploited, an attacker could gain capabilities beyond their intended level, potentially accessing or modifying data they should not be able to reach.
Security Architect’s Take: Review and tighten role assignments in Azure SQL Database, applying least-privilege principles to all database users and service principals — particularly in environments where multiple teams or tenants share the same instance. Monitor Microsoft’s patch guidance and apply any available fixes or mitigations promptly, and consider auditing SQL permission grants for any unexpected elevation paths in the interim.
Original advisory: CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability