CVE-2026-62836

Azure SQL Managed Instance Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 49th percentile. A vendor fix is available.

CVSS 3.18.7High EPSS percentile49th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-06Updated 2026-08-12Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your business uses Azure SQL Managed Instance and confirm it is exposed to incoming network traffic beyond trusted sources.
Verify your current Azure SQL Managed Instance patch/engine version and compare it against the latest Microsoft update guidance for CVE-2026-62836.
Apply the Microsoft fix from the official update guide for CVE-2026-62836 to upgrade to the fixed version Microsoft specifies.
After updating, review access and operation logs for unusual connection patterns and unexpected privilege changes, and keep monitoring for continued suspicious network activity.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

In plain language

Written by AI from the record

CVE-2026-62836 is a serious security flaw in Azure SQL Managed Instance where an internet-based attacker with network access can gain higher permissions without a login; you should act because it’s reachable by default networking.

CVE-2026-62836 is an elevation-of-privilege issue in Azure SQL Managed Instance caused by improper restriction of a network communication channel, enabling an unauthenticated remote attacker to bypass intended security boundaries and escalate privileges without credentials or user interaction (reachable in default configuration).

If you're affected

Full managed instance compromise
Unauthorized access to data
Privilege escalation for attackers
Service integrity and availability risk

What is it

Think of Azure SQL Managed Instance as a shared secure “mailroom” for your database connections. This bug lets a bad actor get higher permissions just by reaching the service in a certain way—no login or user action is required. If someone can reach your instance from the network, they may be able to do more than they should, such as accessing or manipulating what your database is supposed to protect.

Who is affected

This matters if your business runs Azure SQL Managed Instance and attackers could reach it over the network (not just from your internal systems). The issue is reachable in default configuration, so the main question for you is whether your instance has exposed network paths beyond trusted sources. This is only a risk when an attacker has network access to your Azure SQL Managed Instance.

How urgent is it

This is a RED issue because it enables unauthenticated remote privilege escalation and is reachable in default configuration, meaning a realistic attacker path exists if your network exposure is not tightly controlled. While there’s no confirmed dated press report of exploitation for this specific CVE, Microsoft has issued remediation guidance and security actor interest (notably Lazarus group) is reported, so you should treat this as urgent to patch.

What to do — in detail

Confirm exposure and scope
- Identify all Azure SQL Managed Instance deployments used by your business.
- Determine from where connections are allowed (for example, whether any network path permits inbound connections from untrusted networks).
- Because the finding states “reachable in default config: Yes,” pay special attention to any “publicly reachable” or broadly accessible networking routes.
Check for the fixed version
- Use the official Microsoft update guide for CVE-2026-62836 to find the fixed version(s) for Azure SQL Managed Instance.
- Compare the Microsoft guidance against the version/patch level of your managed instance(s).
Patch/upgrade
- Apply Microsoft’s remediation for CVE-2026-62836 as directed in the Microsoft update guide.
- Plan for any operational change required by the service update (follow your vendor’s instructions for maintenance/upgrade windows).
Temporary workaround if patching is delayed
- Reduce network reachability as much as possible: restrict inbound connectivity to only the networks and addresses that must connect to your database (trusted IP ranges / private connectivity).
- Block or remove any routes that allow untrusted sources to reach the managed instance.
Validate after the change
- Review connection and activity logs around the time of the update for unusual patterns (unexpected remote source patterns, spikes in failed/successful connection attempts).
- Look for any evidence of privilege changes or abnormal database activity that doesn’t match normal application behavior.
Continue monitoring
- Keep monitoring network and database audit logs for suspicious behavior until you confirm the fixed state is in place across all affected instances.

CISA due date: Not provided in the findings (KEV not listed in CISA KEV).

Technical context

Severity: High (CVSS 8.7) with an elevation-of-privilege impact model.

What’s happening (mechanism): CWE-923 indicates improper restriction of a communication channel to intended endpoints. In Azure SQL Managed Instance, the handling of network connections can be abused to bypass intended security boundaries and escalate privileges.

Reachability and prerequisites: The findings state authentication is not required, no user interaction is required, and the issue is reachable in default configuration. The practical prerequisite is network access to the Azure SQL Managed Instance.

Exploitation status: No dated, specific public press claim of exploitation is provided, and no public exploit code is on record. KEV is not listed for this CVE in the provided findings.

Actor/interest signals: Patch-focused attention is reported with an actor reference to Lazarus group.

Patch guidance: Microsoft has an official remediation/update guide for CVE-2026-62836 (see msrc.microsoft.com update guide).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 6 days, from the signal feeds we watch.

2026-08-12Patch availablerecord updated
2026-08-11Patch availablerecord updated
2026-08-08Patch availablerecord updated
2026-08-07Patch availablerecord updated, record updated, record updated
2026-08-06Publishedweakness classified

Affected products

Microsoftcommercial · US
- Azure SQL Managed InstanceOn-premOperating Systems / windows

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Scored 8.7 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact

Weaknesses

CWE-923No name in the record

Sources

References in the record

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62836

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Microsoft, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account