# CVE-2026-69502: Microsoft Azure SQL Database server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-69502-microsoft-azure-sql-database-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69502 · Severity: critical · CVSS 10 · Published 2026-08-21

Azure SQL Database is Microsoft's managed relational database service used by enterprises to store and manage critical business data. A server-side request forgery vulnerability allows attackers to make unauthorized requests from the database server itself, potentially gaining administrative access to the database and other backend systems without proper authentication.

Technologies: [Microsoft Azure Sql Database](https://junglewise.ai/threats/technologies/azure-sql-database). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-69502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69502 being exploited in the wild.

**How severe is CVE-2026-69502?** Critical severity, with a CVSS score of 10, published 21 August 2026.

**Which products and versions are affected?** Microsoft Azure SQL Database.

**Is there a fix for CVE-2026-69502?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-69502 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-69502?** Check whether you run Microsoft Azure Sql Database. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in Azure SQL Database that allows an unauthenticated attacker to make arbitrary network requests from the database server context. The vulnerability permits privilege escalation, giving attackers the ability to access resources and backend systems that should be restricted. The attack is network-reachable and requires no authentication or user interaction. Patches are expected from Microsoft via their security update channels.

## Affected products

- Microsoft Azure SQL Database

## Timeline

- 2026-08-21: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69502](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69502)

## Related threats

- [Microsoft Azure SQL Database SQL injection privilege escalation](https://junglewise.ai/threats/cve-2026-68789-microsoft-azure-sql-database-sql-injection-privilege-escalation)
- [Microsoft Azure SQL Database SQL injection in authorization](https://junglewise.ai/threats/cve-2026-68782-microsoft-azure-sql-database-sql-injection-in-authorization)
- [Microsoft Azure SQL Database privilege escalation](https://junglewise.ai/threats/cve-2026-66309-microsoft-azure-sql-database-privilege-escalation)
- [Microsoft Azure SQL Database privilege escalation via incorrect permission assignment](https://junglewise.ai/threats/cve-2026-63522-microsoft-azure-sql-database-privilege-escalation-via-incorrect)