Quick answers
- Is CVE-2026-69502 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-69502 being exploited in the wild.
- How severe is CVE-2026-69502?
- Critical severity, with a CVSS score of 10, published 21 August 2026.
- Which products and versions are affected?
- Microsoft Azure SQL Database.
- Is there a fix for CVE-2026-69502?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-69502 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-69502?
- Check whether you run Microsoft Azure Sql Database. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Azure SQL Database that allows an unauthenticated attacker to make arbitrary network requests from the database server context. The vulnerability permits privilege escalation, giving attackers the ability to access resources and backend systems that should be restricted. The attack is network-reachable and requires no authentication or user interaction. Patches are expected from Microsoft via their security update channels.
Affected products
- Microsoft Azure SQL Database
Timeline
- 2026-08-21: disclosed