Microsoft SQL Server CVE-2026-66820

Exploitation requires a valid SQL Server login with at least low-level (non-guest) authentication credentials (PR:L per CVSS). The attacker must have network access to the SQL Server instance on its standard port (TCP 1433 by default) or via a named pipe/alternative transport. No special server configuration or non-default feature enablement is indicated - this affects standard SQL Server deployments across all supported servicing tracks. Exploitation is limited by the authentication prerequisite: unauthenticated attackers without any SQL credentials cannot exploit this vulnerability. Additionally, SQL Server instances not exposed to untrusted networks (e.g., behind strict firewall rules allowing only application-tier access) reduce the practical attack surface.

The CVSS 8.8 rating is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and full C/I/A impact (S:U, C:H/I:H/A:H). The practical risk is meaningful - SQL Server instances are almost universally reachable by internal application users, contractors, and DBAs, making PR:L a low bar in most enterprise environments. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, so opportunistic internet-scale exploitation is not confirmed; however, the low attack complexity means that once an organization's internal users have low-level SQL credentials, exploitation requires minimal sophistication. The scope of affected versions - four major releases and both servicing tracks - means the exposure surface is large. Even a mid-sized municipal IT team in koszalin running legacy SQL Server 2017 on a GDR track should treat patching as urgent, given that the jump from low-privilege to high-privilege database access can cascade into full server compromise or lateral movement via linked server configurations.

An attacker who has obtained valid low-privilege SQL Server credentials - through phishing, credential stuffing, or insider access - connects to the target SQL Server over the network and submits crafted T-SQL containing injected special elements. The server processes the malformed input without proper sanitization, triggering a privilege escalation that grants the attacker database administrator or higher-level access, enabling full read/write/execute control over the instance. No public proof-of-concept exists at time of analysis.