CVE-2026-87701

CriticalCVSS 9.6/10Last modified Sep 29, 2026

Description

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
MicrosoftAzure Cosmos DB-

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-877027.8Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.CVE-2026-877047.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-877057.4Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature oCVE-2026-877067.8Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.CVE-2026-877077.8Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.CVE-2026-877087.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-877095.5Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.CVE-2026-87717.3A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/CVE-2026-877107.0Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.CVE-2026-877117.8Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-877127.8Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.CVE-2026-877137.5Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.
CVE-2026-87701: Critical severity, CVSS 9.6 | Vulnix