CVE-2026-85878

CVE-2026-85878 is an improper authorization flaw (CWE-285) in Microsoft's Azure Database for PostgreSQL managed service. An attacker who already holds some authorized, low-privilege access — such as an authenticated database user — can send network requests that the service fails to properly authorize, thereby elevating their privileges. The CVSS 3.1 score of 9.9 reflects network exploitability, low attack complexity, no user interaction, a scope change (impact extending beyond the vulnerable component), and high impact on confidentiality, integrity, and availability. All customers running Azure Database for PostgreSQL are potentially affected until remediated. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Check the MSRC advisory and Azure Service Health, and confirm your instances have received Microsoft's service-side fix, as managed Azure databases are typically patched by Microsoft rather than by customer upgrades. Until remediation is confirmed, enforce least-privilege database roles, audit role and admin memberships for unexpected grants, and restrict network exposure using firewall rules, Private Link/Private Endpoints, and VNet integration. Review PostgreSQL audit logs and Microsoft Defender for open-source relational databases alerts for signs of privilege escalation attempts.