Azure Vulnerability Cluster Expands to Data and Financial Tiers
Azure Database for PostgreSQL is vulnerable to CVE-2026-85878, an Improper Authorization flaw (CWE-285) carrying a CVSS score of 9.9. Simultaneously, Azure Billing is affected by CVE-2026-62874, an Insufficient Data Authenticity Verification issue (CWE-345) with a maximum CVSS score of 10.0. Both vulnerabilities were published September 18 and confirmed by Tenable and MITRE. These disclosures confirm that the current Azure vulnerability cluster has moved beyond the initial identity control plane into the data and financial layers of the cloud environment.
CVE-2026-85878 allows an authorized attacker to elevate privileges over the network with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The scope-changed metric means the exploit crosses security boundaries. CVE-2026-62874 is more severe: it requires no authentication at all (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L). An unauthenticated attacker on the network can elevate privileges and potentially compromise the financial integrity of enterprise tenants. Microsoft had not yet published an MSRC advisory for CVE-2026-62874 at the time of check, though the Tenable and MITRE records were live.
Timeline of the Cluster
The cluster originated during the September 3 and September 8 Patch Tuesday cycles. Initial coverage in Azure identity infrastructure identified critical flaws in core services, including CVE-2026-83711 (Azure AD B2C, CVSS 10.0), CVE-2026-70352 (Azure AI Language, CVSS 10.0), and CVE-2026-83941 (Entra ID, CVSS 9.9). CVE-2026-62916 in Entra ID (CVSS 9.1) involved reports of pre-patch exploitation. Additional September disclosures included CVE-2026-69857 (Azure Cosmos DB, CVSS 8.5) and CVE-2026-69854 (Spring Cloud Azure, CVSS 9.0).
Activity intensified September 17-18. CVE-2026-77903 (Microsoft Dataverse, CVSS 9.0) and CVE-2026-69843 (Microsoft Fabric, CVSS 10.0) arrived within one day of each other. As noted in the Fabric authentication bypass, the billing vulnerability was initially identified as unrelated to the Fabric disclosure but is now confirmed as a standalone critical issue. CVE-2026-85889 (Azure AI Foundry, CVSS 10.0) remains unverified pending MSRC and GitHub confirmation.
Widening Attack Surface
The initial cluster targeted the identity control plane – AD B2C, Entra ID. The second wave extended into AI services (AI Language, AI Foundry). The third wave hit the data and analytics tier: Dataverse, Fabric, PostgreSQL, Cosmos DB. Now Azure Billing marks a fourth category: the financial layer. The attack surface has widened from who can authenticate, to what AI endpoints trust, to where data lives, to how billing is verified.
Across these 10+ verified CVEs, most share a structural pattern: authentication or authorization logic fails in a way that allows an attacker to bypass trust boundaries without credentials. Seven of the ten are unauthenticated. All were addressed through Microsoft server-side fixes, requiring no customer action. The breadth of services affected – 10 distinct Azure offerings – indicates these are not isolated implementation bugs but symptoms of a shared architectural dependency on authentication logic that has not kept pace with service expansion.
What to Watch
- MSRC for CVE-2026-62874 and CVE-2026-85889: Billing has no published MSRC advisory yet. AI Foundry remains unconfirmed by primary sources. Both need resolution.
- Exploitation telemetry: CVE-2026-62916 (Entra ID) had pre-patch exploitation reports. Watch whether the newly disclosed data-tier and billing CVEs attract similar activity.
- Cross-service chaining: Microsoft Fabric integrates data engineering, science, and warehousing under one platform. An unauthenticated bypass in Fabric combined with a billing-layer bypass could expose both data and cost controls.
- Next Patch Tuesday cycle: The September cluster spans two Patch Tuesday cycles plus multiple out-of-band disclosures. Whether the October cycle continues the pattern or stabilizes will determine if this is an acceleration or a peak.