| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 9.7 | $5k-$25k | 1.96- |
Summary
A vulnerability was found in Microsoft Azure HorizonDB and classified as very critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2026-85878. It is possible to launch the attack remotely. No exploit is available. This product operates as a managed service, which prevents users from maintaining vulnerability countermeasures themselves.
Details
A vulnerability was found in Microsoft Azure HorizonDB (the affected version is unknown). It has been declared as very critical. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
The advisory is shared for download at msrc.microsoft.com. This vulnerability was named CVE-2026-85878 since 09/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/18/2026). The MITRE ATT&CK project declares the attack technique as T1548.002.
This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Product
Type
Vendor
Name
License
Managed Service
- yes
Website
- Vendor: https://www.microsoft.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 9.9VulDB Meta Temp Score: 9.7
VulDB Base Score: 9.9
VulDB Temp Score: 9.5
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 9.9
CNA Vector (microsoft): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Improper authorizationCWE: CWE-285 / CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Status: 🔍0-Day Time: 🔒
Timeline
09/04/2026 CVE reserved09/17/2026 VulDB entry created
09/18/2026 Advisory disclosed
09/18/2026 VulDB entry last update
Sources
Vendor: microsoft.comAdvisory: msrc.microsoft.com
Status: Confirmed
CVE: CVE-2026-85878 (🔒)
GCVE (CVE): GCVE-0-2026-85878
GCVE (VulDB): GCVE-100-407320
Entry
Created: 09/18/2026 01:42Changes: 09/18/2026 01:42 (61)
Complete: 🔍
Cache ID: 216::103
VulDB is the best source for vulnerability data and more expert information about this specific topic.
No comments yet. Languages: en.
Please log in to comment.