CVE-2026-87701: Microsoft Azure Cosmos DB

Critical severity, CVSS 9.6. EPSS: 0.8% chance of exploitation in the next 30 days.

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

Affected products

• Microsoft Azure Cosmos DB: affected versions not specified

Published 2026-09-17. Last modified 2026-09-29.