MicrosoftCVE-2026-66803

Microsoft Azure Cosmos DB: improper access control

Critical10.0CVE-2026-66803 · Published Jul 30, 2026 · updated Aug 4, 2026

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Azure Cosmos DB Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-284

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Aug 4	Microsoft Edge: unauthorized attacker could disclose information over High7.4Aug 4 CVE-2026-65802151.0.4129.59	High7.4	151.0.4129.59
Aug 4	Microsoft Office Excel: use after free High8.8Aug 4 CVE-2026-6287016.0.5561.1001	High8.8	16.0.5561.1001
Jul 28	Microsoft Edge for Android: improper input validation Medium5.4Jul 28 CVE-2026-62828No fix yet	Medium5.4	No fix yet
Jul 26	Microsoft Edge (Chromium-based): origin validation error High7.4Jul 26 CVE-2026-57989150.0.4078.99	High7.4	150.0.4078.99
Jul 26	Microsoft Edge (Chromium-based): exposed files High7.4Jul 26 CVE-2026-57990No fix yet	High7.4	No fix yet
Jul 26	Microsoft Edge (Chromium-based): spoofing Medium5.4Jul 26 CVE-2026-57978150.0.4078.99	Medium5.4	150.0.4078.99

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.