Microsoft SQL Server CVE-2026-66814

The attacker must possess a valid SQL Server login with at minimum low-level database access (PR:L). Exploitation occurs over a standard network SQL Server connection (AV:N, default port TCP 1433), with no required user interaction and low attack complexity (AC:L), meaning no race condition or special timing is needed. Limiting factors include: the requirement for a pre-existing authenticated SQL Server credential (ruling out fully unauthenticated external attackers), and the constraint that Scope:Unchanged means the privilege escalation is bounded within the SQL Server process trust boundary. Exploitation does not require non-default configuration - the flaw exists in the core access control layer of the affected versions.

The CVSS 8.8 score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a straightforward, low-complexity network privilege escalation requiring only a valid database credential - no user interaction, no race condition, no special network position. The full triad of C:H/I:H/A:H indicates total compromise of the SQL Server instance post-exploitation, including access to all databases, ability to modify or destroy data, and potential denial of service. No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, meaning active mass exploitation has not been confirmed. The absence of a public POC reduces near-term opportunistic exploitation risk, but the broad affected surface - four major SQL Server release generations - means even a mid-sized municipal IT team in zabrze should treat this as urgent given the number of patch tracks to manage simultaneously. The primary realistic threat is lateral movement by an attacker who has already obtained a low-privilege SQL account (e.g., via credential leak or phishing of an application service account), using this flaw to escalate within the database tier before pivoting to the OS or other systems.

An attacker who has obtained a low-privilege SQL Server login - for example, an application service account credential extracted from a misconfigured web application - connects to the SQL Server instance over the network and exploits the access control granularity flaw to elevate to a higher-privileged role. With elevated privileges, the attacker can read all database contents including credentials stored in application tables, modify or delete data, or execute OS commands via features such as xp_cmdshell if enabled. No public proof-of-concept exploit has been identified at time of analysis.