CVEvulnerability

CVE-2026-62895

8.8 HIGH Published 2026-09-08 Modified 2026-10-20 Official page ↗
Status
Analyzed
Published
2026-09-08
Last modified
2026-10-20
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1390, CWE-89, CWE-942

Description

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Affected configurations

• microsoft azure arc sql server extension (< 1.1.3518.465)

Related

Weakness · CWE (3)

  • CWE-1390 Weak Authentication weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References