CVE-2026-66800 is a high severity (CVSS 8.6) server-side request forgery in Azure Data Factory that allows an unauthorized attacker to disclose information over a network. Microsoft says it has already fully mitigated the issue in the service. Customers have no action to take, and the CVE exists for transparency.
What's affected
The record describes server-side request forgery (CWE-918) in Azure Data Factory allowing an unauthorized attacker to disclose information over a network. It lists the product as Azure Data Factory with no version range, which fits a cloud service that the vendor runs.
Microsoft's update guide scores it 8.6 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, matching the record. The entry says "Customer Action Required: No". Its FAQ states that the vulnerability has already been fully mitigated by Microsoft and that the purpose of the CVE is to provide further transparency about cloud service issues.
Microsoft marks it as not publicly disclosed and not exploited at release. The record's KEV flag is false.
How to check if you're exposed
There is nothing to install and no version to read. The fix lives on Microsoft's side of the shared responsibility line. You do not run the vulnerable code, so there is no host to scan.
What you can do is check that nothing in your own pipelines depends on assumptions that a server side request issue would break. For example, review the network and identity setup around your Data Factory instances.
What to do now
- Record the CVE and Microsoft's statement that no customer action is required, for your vulnerability register.
- Mark it as vendor mitigated, not as open, in your tracking so it does not sit in a backlog.
- Review the identities and network paths your Data Factory pipelines use, and remove access that is not needed.
- Read Microsoft's note on cloud service CVEs to understand why entries like this one are published.
- Do not spend patch effort here. Spend it on the entries that need an update.
Why it matters
Server side request forgery makes a server send a request to a place the attacker chooses. In a cloud data service, the dangerous destinations are internal addresses and metadata endpoints that an outside client cannot reach. The vector here marks the scope as changed, which means the impact could reach beyond the vulnerable component.
That is the reason for the high score, even though the practical risk to customers is low once the vendor has fixed it. Cloud providers now publish CVEs for service side fixes so that customers can see them. The right response is to note it and move on, and reviewing your own access setup is a good use of the same hour.
Quick check
Do I need to patch Azure Data Factory?
No. Microsoft says it has fully mitigated this issue and that no customer action is required.
Why does a fixed cloud bug get a CVE?
Microsoft says the purpose is transparency about cloud service vulnerabilities.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-66800
- NVD record for CVE-2026-66800
Last reviewed: 18 October 2026.
