CVE-2026-66803 is a critical vulnerability in Azure Cosmos DB caused by improper access control (CWE-284). It enables an attacker with no privileges or user interaction to execute arbitrary code remotely, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. No patch or remediation details are provided, and the service is not cloud-hosted according to the data.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on Azure Cosmos DB, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can lead to data breaches, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud-hosted service, users should monitor official Microsoft advisories for updates or patches addressing this vulnerability. Until a fix is available, restrict network access to the affected service and apply any recommended access control policies.