CVE-2026-85878

www.tenable.com • September 18, 2026

Share: View original

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

Published : 2026-09-18

Vector : CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Azure Vulnerabilities Affect PostgreSQL and Billing Systems On September 18, 2026, Microsoft Azure disclosed two critical vulnerabilities: CVE-2026-85878, an Improper Authorization flaw in Azure Database for PostgreSQL with a CVSS score of 9.9, and CVE-2026-62874, an Insufficient Data Authenticity Verification issue in Azure Billing with a maximum CVSS score of 10.0. Both vulnerabilities allow attackers to elevate privileges, with CVE-2026-62874 being particularly severe as it requires no authentication. This cluster of vulnerabilities extends beyond the identity control plane into data and financial layers, indicating a widening attack surface. The vulnerabilities were confirmed by Tenable and MITRE, but Microsoft had not yet issued an advisory for CVE-2026-62874. The timeline of vulnerabilities includes several critical flaws disclosed during the September Patch Tuesday cycles, with activity intensifying in mid-September. All vulnerabilities were addressed through server-side fixes by Microsoft, requiring no action from customers. 6 sources 72

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

CWE-269 - Improper Privilege Management CWE-287 - Improper Authentication

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (1)

Azure Database For PostgreSQL