This vulnerability (CVE-2026-63522) in Microsoft Azure SQL Database is classified under CWE-732, which pertains to incorrect permission assignment for critical resources. It enables an authorized attacker with local access to elevate their privileges within the system. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages patching for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63522.

An authorized attacker with local privileges on Azure SQL Database could exploit this vulnerability to gain elevated permissions, potentially compromising confidentiality, integrity, and availability of the database resources. This could lead to unauthorized data access or modification and disruption of database services.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure SQL Database as a cloud service. Users should verify that their Azure SQL Database instances are updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63522. No additional user action is typically required beyond ensuring the service is up to date.