CVE-2026-62895: Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Published Sep 8, 2026
·Updated
Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Other sources
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Azure Arc SQL Server Extension
Microsoft Azure Arc SQL Server Extension<1.1.3518.465
1.1.3518.465
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.3518.465
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·05:10 PM
Data Sourced
via MITRE·05:10 PM
DescriptionSeverity
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need prior credentials or user interaction to exploit this issue?
The CVSS vector indicates no privileges are required (PR:N), but user interaction is required (UI:R). The attack is network-based (AV:N) with low attack complexity (AC:L).
2
What is the potential security impact if exploitation succeeds?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. The CVSS vector indicates the impact remains within the affected security authority (S:U).