CVE-2026-69857

CVE-2026-69857 is an authorization bypass through a user-controlled key (CWE-639, an IDOR-style flaw) in Microsoft Azure Cosmos DB, Microsoft's managed NoSQL database service: an authenticated principal can supply or alter a resource identifier (key) that the service fails to validate against the caller's permissions. Triggered over a network by a low-privileged, authorized user who manipulates such a key (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N), the flaw lets the attacker bypass access checks and perform spoofing, i.e., impersonate another identity or act outside their authorized scope. Per the CVSS vector, successful exploitation carries high impact on the confidentiality, integrity, and availability of data in the affected database account, since the attacker can read or modify data as a different authorized identity. Any organization using Azure Cosmos DB is potentially affected; because it is a fully managed Azure service there are no customer-managed installations, and no affected version ranges are specified in the advisory data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday cycle (966 flaws fixed, including 2 zero-days); no public proof-of-concept is known, it is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days.

What to do: Review Microsoft's September 2026 security update guidance for CVE-2026-69857 and complete any required updates or customer-side actions for Azure Cosmos DB, confirming whether key rotation, RBAC/permission changes, or SDK updates are needed on your accounts. Because exploitation requires an authorized (authenticated) principal, audit who and what has access to Cosmos DB accounts, enforce least privilege on account keys and RBAC roles, and rotate account keys if exposure is suspected. No public PoC or in-the-wild exploitation is known and EPSS is low (~0.4% over 30 days), so treat this as high-priority routine patching within the normal Patch Tuesday cycle rather than an emergency.