CVE-2026-66803 describes an improper access control vulnerability in Microsoft Azure Cosmos DB. The flaw allows an unauthorized, unauthenticated attacker to execute arbitrary code over a network without requiring user interaction. The vulnerability is currently awaiting full analysis by NVD. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The issue is classified as a remote code execution vulnerability, making it potentially critical for organizations relying on Azure Cosmos DB. No additional technical details or proof-of-concept exploits are referenced in the current disclosure.