What is the CVSS score of CVE-2026-20803?

CVE-2026-20803 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sql Server 2022 are affected by CVE-2026-20803?

Organizations using Missing authentication for critical function in SQL Server face moderate risk from CVE-2026-20803, a missing authentication vulnerability rated CVSS 7.2.. A patch is available.

How to fix or mitigate CVE-2026-20803?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Sql Server 2022 CVE-2026-20803

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-01-13 secure@microsoft.com

Sql Server 2022 Sql Server 2025 Authentication Bypass

7.2

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 18:16 nvd

HIGH 7.2

DescriptionCVE.org

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in SQL Server 2022 and 2025 stems from insufficient authentication controls on critical functions, enabling authenticated network attackers to gain elevated privileges. The vulnerability affects administrators and authenticated users with network access to affected SQL Server instances. No patch is currently available, and exploitation requires high privileges but no user interaction.

Technical ContextAI

Classified as CWE-306 (Missing Authentication for Critical Function). Affects Sql Server 2022. Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.