CVE-2026-69857 is a high severity flaw in Azure Cosmos DB, scored 8.5 by the record. Per the NVD record, it allows an authorized attacker to perform spoofing over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists Azure Cosmos DB as the affected product. The record describes the issue this way: Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
The record gives a CVSS 3.1 base score of 8.5 (HIGH), published 2026-09-03, with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector reads as follows. Access is over the network, attack complexity is high, and privileges required are low. No user interaction is needed. Scope is changed, meaning impact can cross a security boundary. Confidentiality, integrity and availability impact are high, high and high.
Microsoft publishes fixed builds on its Security Update Guide, and that page needs a browser to render, so we could not read it automatically. Take version details from there. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
This is a Microsoft cloud service, so you do not install a patch the way you would on a Windows host. Open the Microsoft advisory and read what it says about whether the fix was applied by Microsoft or needs action from you. Then review which of your subscriptions and workspaces use Azure Cosmos DB, and who holds roles on them. Role assignments and access logs are the places where an authorization flaw would show up first.
What to do now
- Read the Microsoft advisory and see whether the fix is applied by Microsoft or needs action from you.
- Review role assignments on the affected service and remove access that is no longer needed.
- Check the service's access logs for unusual requests since the publish date.
- Record what you found, even if the answer is that nothing needed doing.
Why it matters
CWE-639 (authorization bypass through user-controlled key) describes a weakness where a caller-supplied identifier is trusted to pick a record, so changing it reaches data that belongs to someone else.
Access control flaws in a hosted service or an identity library are hard to see from the outside. The fix may sit with the vendor, but the review of who has access and what the logs show stays with you.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Do I need to patch anything myself?
Possibly not. For a Microsoft hosted service the vendor often applies the fix. The advisory says whether anything is needed on your side.
Sources
- Microsoft Security Update Guide entry for CVE-2026-69857 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-69857 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
