Critical Azure Vulnerabilities Affect PostgreSQL and Billing Systems

• •CVE-2026-62874 has a CVSS score of 10.0 and allows unauthenticated privilege escalation.
• •CVE-2026-85878 allows authorized attackers to elevate privileges in PostgreSQL.
• •The vulnerabilities indicate a significant expansion of the Azure attack surface into financial systems.

On September 18, 2026, Microsoft Azure disclosed two critical vulnerabilities: CVE-2026-85878, an Improper Authorization flaw in Azure Database for PostgreSQL with a CVSS score of 9.9, and CVE-2026-62874, an Insufficient Data Authenticity Verification issue in Azure Billing with a maximum CVSS score of 10.0. Both vulnerabilities allow attackers to elevate privileges, with CVE-2026-62874 being particularly severe as it requires no authentication. This cluster of vulnerabilities extends beyond the identity control plane into data and financial layers, indicating a widening attack surface. The vulnerabilities were confirmed by Tenable and MITRE, but Microsoft had not yet issued an advisory for CVE-2026-62874. The timeline of vulnerabilities includes several critical flaws disclosed during the September Patch Tuesday cycles, with activity intensifying in mid-September. All vulnerabilities were addressed through server-side fixes by Microsoft, requiring no action from customers.