Microsoft SQL Server CVE-2026-66816

Exploitation requires a valid SQL Server login with at least low-level database access (PR:L per the CVSS vector) on an affected SQL Server 2022 or 2025 instance reachable over the network. The attack requires no user interaction from any victim. The specific SQL operations or audit event categories that trigger the logging gap are not disclosed in available public data, meaning successful exploitation may require insider knowledge or trial-and-error enumeration of unlogged events. Exploitation is bounded by the authentication requirement - unauthenticated remote attackers cannot exploit this without first obtaining SQL Server credentials. Environments that do not use SQL Server Audit at all are not made worse by this flaw, but they also lack audit visibility regardless.

The CVSS 6.5 Medium score accurately reflects the constrained threat model: exploitation requires prior authentication (PR:L), which limits opportunistic mass exploitation. Nevertheless, the C:H impact signal is significant - the logging gap enables high-confidentiality data to be accessed or sensitive operations to be performed outside the audit record, which is precisely the control defenders rely on for insider-threat detection and compliance enforcement. The network vector (AV:N) and lack of user-interaction requirement (UI:N) mean any valid database user can exploit this remotely, making the insider-threat and compromised-credential scenarios realistic. No EPSS data or CISA KEV listing is provided, and no public proof-of-concept has been identified, which moderates immediate urgency. The 'Authentication Bypass' metadata tag mischaracterizes the vulnerability - the bypass is of an audit/logging security feature (CWE-778), not of the authentication mechanism itself. Database teams running SQL Server in regulated environments (PCI-DSS, HIPAA, SOC 2) should prioritize this patch, as the flaw undermines audit integrity controls that compliance frameworks depend on.

A low-privilege SQL Server user authenticates over the network to an unpatched SQL Server 2022 or 2025 instance and executes queries against sensitive tables or performs actions that would normally trigger audit log entries. Because the logging flaw causes those events to be silently dropped, the attacker exfiltrates data (C:H) without any corresponding audit record being written to the SQL Server Audit target. No public POC exists, so the attacker must have knowledge of or discover which specific operations are not logged.