CVE-2026-26145 — Microsoft Azure Synapse Elevation of Privilege Vulnerability

Executive Summary

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

Overview

9.8

CVSS CRITICAL

Critical

MS Severity

Not Exploited

MS Exploit Status

N/A

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-284: Improper Access Control

Released Jul 14 2026

Last Updated Jul 14 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00359 — 0.28857 percentile

NVD CVSS 9.8 CRITICAL — differs from MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

ATTACK VECTOR

Network

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

None

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

None

AVAILABILITY

None

EXPLOIT CODE MATURITY

Proof-of-Concept

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 4.3

EPSS Score

0.00359

probability of exploitation in the next 30 days

0.28857 percentile - updated 2026-08-14

View on FIRST.org

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

Anonymous

References

MSRC Advisory MITRE NVD