CVE-2026-68789: Azure SQL Database Elevation of Privilege Vulnerability
Published Aug 20, 2026
·Updated
Azure SQL Database Elevation of Privilege Vulnerability
Other sources
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
1 affected component
Microsoft Azure SQL Database
Event History
Aug 20, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·09:43 PM
Data Sourced
via MITRE·09:43 PM
DescriptionSeverity
Frequently Asked Questions
1
Can this be exploited remotely without user interaction?
Yes. The CVSS vector indicates network attack access (AV:N) and no user interaction requirement (UI:N).
2
What level of access does an attacker need before exploiting this issue?
The attacker must be authorized and have low privileges (PR:L).