The vulnerability allows an attacker with authorized access to execute code with unnecessary privileges, thereby elevating their privileges across the Azure Synapse network. It is a classic improper authorization flaw (CWE-250) that can compromise the confidentiality, integrity, and availability of data and services by granting the attacker broader access than intended.

Microsoft Azure Synapse is the affected product. No specific versions are listed in the available data, so all deployments of Azure Synapse may be subject to this flaw until a patch is applied.

The CVSS score of 9.9 indicates a severe threat. The EPSS score is not available, but the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is an authorized attacker who already has some level of access to the Azure Synapse environment; by exploiting the unnecessary privilege execution path, the malicious actor can expand their access rights. Since the description does not specify additional prerequisites, it is inferred that the attacker merely needs authenticated access to leverage this flaw.