What is CVE-2026-27969?

CVE-2026-27969 is a security advisory published by Microsoft Security Response Center (MSRC) with Critical severity. Vitess users with backup storage access can write to arbitrary file paths on restore

Which CVE IDs does CVE-2026-27969 cover?

CVE-2026-27969 covers the following CVE IDs: CVE-2026-27969. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2026-27969?

CVE-2026-27969 affects 4 products, including: azl3 vitess 19.0.4-7 on Azure Linux 3.0; azl3 vitess 19.0.4-9 on Azure Linux 3.0; cbl2 vitess 17.0.7-12 on CBL Mariner 2.0; cbl2 vitess 17.0.7-14 on CBL Mariner 2.0.

CVE-2026-27969Critical

Vitess users with backup storage access can write to arbitrary file paths on restore

Vendor

Microsoft Security Response Center (MSRC)

Published

February 27, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-27969 →

🎯 Affected products4

azl3 vitess 19.0.4-7 on Azure Linux 3.0
azl3 vitess 19.0.4-9 on Azure Linux 3.0
cbl2 vitess 17.0.7-12 on CBL Mariner 2.0
cbl2 vitess 17.0.7-14 on CBL Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 19.0.4-8 KBCBL-Mariner Releases (Security Update) — fixed build 17.0.7-15

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27969
referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade