Microsoft SQL Server CVE-2026-66818

A valid SQL Server login with at minimum low-privilege access (PR:L per CVSS) is required; unauthenticated exploitation is not possible. No non-default SQL Server feature, configuration option, or specific operating system version is required - any network-reachable SQL Server 2017/2019/2022/2025 instance running a vulnerable build is exploitable by any user holding a login. Network reachability to the SQL Server TDS listener (typically TCP 1433) is necessary. The unchanged scope (S:U) confirms escalation remains within the SQL Server process - OS-level impact would require chaining additional techniques. Exploitation is strictly limited to actors who can authenticate to SQL Server; attackers with no database credentials cannot exploit this vulnerability.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat profile: the flaw is network-reachable with no attack complexity, requires no user interaction, and yields full C/I/A impact once privilege escalation succeeds. The only meaningful barrier is possession of a low-privilege SQL Server account - a threshold that is low in most enterprise environments where application service accounts, reporting users, and contractor logins routinely hold minimal credentials. No EPSS score was included in the provided data, and neither a CISA KEV listing nor public exploit code has been identified, which moderates the immediate mass-exploitation risk; however, the broad deployment footprint of SQL Server and the straightforward nature of privilege-escalation primitives mean the window between disclosure and weaponized tooling may be short. SSVC signals: exploitation status not confirmed, automatable once credential access exists, technical impact total - placing this firmly in the urgent patch tier. The Scope:Unchanged metric correctly reflects that post-escalation impact is contained within the SQL Server process boundary, not extending to the underlying OS unless combined with other techniques.

An attacker who has obtained a low-privilege SQL Server login - for example, through credential theft from an application config file or a database connection string - connects to the SQL Server listener over the network and issues crafted requests that trigger the improper privilege management logic, escalating their session to a higher-privilege role such as sysadmin. From that position they can read all databases including credential stores, modify or delete records, or deny service to legitimate users. No public exploit code has been identified, but the network-accessible, low-complexity attack surface makes this a realistic post-breach lateral movement technique.