Exploitation observed; activity peaked at 5 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
Priority
HIGH
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-09-18 | 5 | Active Exploitation1Disclosure4 |
| 2026-09-22 | 2 | Patch2 |
| 2026-10-08 | 1 | Disclosure1 |
| 2026-10-11 | 1 | Patch1 |
| 2026-10-13 | 1 | General1 |
Alhamdulilah, My highest bounty so far, this was found back then using opus 4.6(and some skills) on azure horizondb CVE-2026-85878 https://t.co/vevhzKrD1N
Post summary
The post claims the author found CVE-2026-85878 in Azure HorizonDB and received their highest bounty so far. It provides no PoC, exploit details, technical description, active-exploitation claim, or remediation information.
Microsoft fixed a critical EoP (9.9) in azure horizondb I reported to @msftsecresponse (reporting on msrc became sooo smooth) https://www.rapid7.com/db/vulnerabilities/cve-2026-85878/ Btw, this was before sol and daybreak.
Post summary
The post discloses a critical elevation-of-privilege vulnerability (CVSS 9.9) in Azure HorizonDB that Microsoft fixed, but it lacks PoC, exploit tool, active exploitation, or specific patch/workaround details.
‼️ A bug bounty hunter used **Opus 4.6** to find a privilege escalation flaw in Azure HorizonDB, Microsoft's managed PostgreSQL database. The problem: CVE-2026-85878 is an improper authorization weakness (CWE-285). In plain terms, someone who already has legitimate network access can raise their own privileges and potentially take full control of the database and its data. The attack vector is network, which means no physical interaction is needed: a machine connected to the right network is enough. What I take from it: the flaw was found by pointing a code-oriented model at the attack surface, not by reading the code by hand. The workflow increasingly looks like "a harness around a model", and the harness is the layer that wires the model to files, tools and the terminal. The gesture is what matters, not the model alone. What I recommend: audit roles and permissions on your Azure PostgreSQL instances, especially anything that can modify roles. Check Microsoft's published fixes for HorizonDB and managed PostgreSQL. Detect escalation attempts: unusual queries against system tables, role changes that don't line up with a deployment. Early report: these facts come from first disclosures and are not confirmed yet. Expect them to change.
Post summary
The text describes a reported Azure HorizonDB authorization flaw that could enable privilege escalation and recommends checking Microsoft's published fixes. It provides technical details but does not report active exploitation or share PoC or exploit code.
Microsoft / Azure tarafında bugün yayınlanan kritik güvenlik açıkları: — CVE-2026-69843: Microsoft Fabric CVSS: 10.0 Etkisi: Kimlik doğrulama atlatma (spoofing). Yetkisiz bir saldırganın ağ üzerinden kimlik doğrulamayı aşarak yetki yükseltmesine izin veriyor. — CVE-2026-62874: Azure Billing CVSS: 10.0 Etkisi: Veri doğrulama yetersizliği. Saldırgan tarafından sağlanan verinin yeterince doğrulanmaması, ağ üzerinden yetki yükseltmeye yol açabiliyor. — CVE-2026-85889: Azure AI Foundry CVSS: 10.0 Etkisi: Kritik bir fonksiyonda kimlik doğrulama eksikliği. Yetkisiz saldırgan ağ üzerinden kritik işlevi çağırarak yetki yükseltebiliyor. — CVE-2026-69865: Microsoft/Azure Container Registry CVSS: 10.0 Etkisi: Kullanıcı kontrollü anahtar üzerinden yetkilendirme atlatma. Yetkisiz saldırganın ağ üzerinden yetki yükseltmesine izin veriyor. — CVE-2026-69399: Azure Arc CVSS CVSS: 10.0 Etkisi: Confused Deputy / istem dışı proxy problemi. Azure Arc'ın başka bir güvenlik bağlamında gerçekleştirdiği işlemler kötüye kullanılarak yetki yükseltme mümkün. — CVE-2026-85878: Azure Database for PostgreSQL CVSS: 9.9 Etkisi: Hatalı yetkilendirme. Düşük seviyede yetkisi olan bir saldırgan ağ üzerinden daha yüksek yetkiler elde edebiliyor. — CVE-2026-87701: Azure Cosmos DB CVSS: 9.6 Etkisi: Injection açığı. Çıktıdaki özel karakterlerin yeterince filtrelenmemesi, yetkili bir saldırganın ağ üzerinden yetki yükseltmesine yol açabiliyor. — CVE-2026-85885: Microsoft 365 Copilot CVSS: 9.9 Etkisi: Command injection. Yetkili bir saldırganın özel hazırlanmış girdilerle komut enjeksiyonu gerçekleştirerek yetki yükseltmesine neden olabiliyor.
Post summary
The text is a disclosure of multiple critical Microsoft/Azure CVEs with detailed technical information including CVSS scores and vulnerability types, but lacks any PoC, exploit tool references, active exploitation claims, or patch/remediation information.
CVE-2026-85878 Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. https://www.cve.org/CVERecord?id=CVE-2026-85878
Post summary
The text is a brief disclosure of CVE-2026-85878 detailing an improper authorization vulnerability in Azure Database for PostgreSQL enabling privilege escalation. It provides basic technical details but mentions no PoC, exploit tool, active exploitation, or patch.
@mainteemoforfun Thanks for the correction: 4.6 for the groundwork, 4.8 for the final push to CVE-2026-85878. What did 4.8 get that 4.6 kept missing, the auth path itself or the request that bypassed it?
Post summary
The post asks how versions 4.6 and 4.8 relate to CVE-2026-85878 and hints at an authentication bypass. It provides no PoC, named exploit, active-exploitation claim, or remediation guidance.
Microsoft, Azure AI Foundry'de Maksimum Ciddiyette (CVSS 10.0) Bir Yetki Yükseltme Açığını Kapattı! Güvenlik araştırmacısı Rémy Marot'un keşfettiği CVE-2026-85889 (CVSS 10.0), Azure AI Foundry'de kritik bir işlevin kimlik doğrulamasını tamamen atlayarak, yetkisiz bir saldırganın ağ üzerinden yetki yükseltmesine izin veriyordu. • Microsoft, açığın vahşi doğada istismar edildiğine dair kanıt bulunmadığını belirtti; sorun bulut tarafında tamamen giderildiği için müşterilerin herhangi bir işlem yapmasına gerek kalmadı. • Aynı güncelleme paketinde CVE-2026-85885, CVE-2026-85878 ve CVE-2026-87701 dahil başka kritik açıklar da kapatıldı. Kurumların hızla benimsediği AI geliştirme platformlarında maksimum ciddiyette bir açığın ortaya çıkması, yapay zeka altyapısının da klasik bulut hizmetleri kadar titiz güvenlik denetimine tabi tutulması gerektiğini gösteriyor. #SiberGüvenlik #Azure #YapayZeka
Post summary
Microsoft announced that CVE‑2026‑85889, a critical (CVSS 10.0) privilege‑escalation flaw in Azure AI Foundry, has been fully patched via a cloud‑side update that requires no customer action, and the fix is included in the same update that addresses several other CVEs.
Critical vulnerability CVE-2026-85878 hits Azure Postgres. It is a CVSS 9.9 privilege escalation risk. Audit your application credentials and patch immediately. #Security #Azure #PostgreSQL #CVE
Post summary
The tweet announces CVE-2026-85878 as a critical CVSS 9.9 privilege escalation flaw in Azure Postgres and ends with an explicit call to patch immediately, with no PoC, exploit tool, or active-exploitation claim mentioned.
An unauthenticated attacker could have seized control of Azure AI Foundry with a single CVSS 10 flaw that Microsoft fixed server-side with no customer steps required. CVE-2026-85889 stemmed from missing authentication on a critical function, letting any network caller escalate without credentials. The September 18 2026 advisory listed no observed exploitation. CVE-2026-85885 allowed command injection in Microsoft 365 Copilot via an authorized network path. CVE-2026-85878 bypassed authorization checks in Azure Database for PostgreSQL. CVE-2026-87701 failed to neutralize input in Azure Cosmos DB. All three carried CVSS 9.9 scores and were already mitigated server-side. CVE-2026-62721 gave SYSTEM to a local attacker in Windows User-Mode Power Service because access control checks lacked granularity. The September 2026 Cumulative Update KB5129194 shipped build 28000.2956 for Windows 11 26H1 on arm64 and x64. CVE-2026-85921 triggered a double free in Windows Secure Kernel Mode on the same out-of-band package, enabling elevation to VTL1. Microsoft addressed 974 vulnerabilities that week. An actively exploited ALPC flaw was chained with two Chrome bugs into the BlueMoon kit used by targeted actors. Defenders should verify the latest cumulative updates are applied across Windows and Azure workloads.
Post summary
The report details multiple high-severity Microsoft vulnerabilities patched in September 2026, highlights an actively exploited ALPC flaw used in the BlueMoon exploit kit, and urges immediate application of cumulative updates across Windows and Azure environments.
⚠️ Vulnerabilidad en Azure Database para PostgreSQL ❗ CVE-2026-85878 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-azure-database-para-postgresql/ https://t.co/lEwodBAPhp
Post summary
The tweet announces CVE-2026-85878 affecting Azure Database for PostgreSQL and shares links for further information, but provides no details on the vulnerability's nature, exploit availability, active use, patches, or false‑positive status.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | azure_horizondb | - | - | - |