CVE-2026-62836 is a high severity (CVSS 8.7) flaw in Azure SQL Managed Instance. Improper restriction of a communication channel to intended endpoints lets an unauthorized attacker elevate privileges over a network. The record names no version. Read the Microsoft entry and review your instance networking.
What's affected
- Product: Microsoft Azure SQL Managed Instance.
- Description in the record: improper restriction of communication channel to intended endpoints allows an unauthorized attacker to elevate privileges over a network.
- Fixed version: the record gives no version, since this is a cloud service. Microsoft's entry is the place to confirm whether you need to do anything.
- Weakness: CWE-923, improper restriction of communication channel to intended endpoints. CVSS 8.7, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N.
How to check if you're exposed
Cloud service flaws like this are normally remediated by the provider, and the record names no customer action. I could not load Microsoft's entry, so confirm there whether anything is required of you. Whatever the answer, these checks are worth running.
az sql mi list --query "[].{name:name,publicEndpoint:publicDataEndpointEnabled}" -o table
What to do now
- Open the Microsoft entry and note any required customer action.
- Review the network security group and route table rules for the managed instance subnet.
- Disable the public endpoint if you do not need it, and allow only the sources you expect.
- Review logins and administrative roles on the instance.
- Turn on auditing and send logs somewhere you review.
Why it matters
The name of the weakness tells the story: a channel that should talk only to certain endpoints can be reached by others. The vector shows high attack complexity, which narrows the practical risk, while the changed scope and high impact explain the 8.7.
The class is CWE-923. Network layer limits are the right defense in depth for any database. They help whether or not this flaw touches you. The record's KEV flag is false.
Quick check
Does the record give a fixed version?
No. It is a cloud service, so check Microsoft's entry for any customer action.
What is the best general control?
Restrict which networks and endpoints can reach the instance, and disable the public endpoint if it is not needed.
Sources
- Microsoft Security Response Center entry (listed in the record, but it did not load when I reviewed it)
Last reviewed: 19 October 2026.
