Microsoft SQL Server CVE-2026-67370

The attacker must possess a valid, low-privilege SQL Server login credential and network-level access to the SQL Server instance (typically TCP 1433 or a named-pipe equivalent). No special configuration, non-default feature, or elevated role is required beyond holding any authenticated session - the PR:L rating confirms this. Exploitation is limited by: (1) requirement for a valid database login (unauthenticated exploitation is not possible per PR:L), and (2) network reachability to the SQL Server endpoint. Environments where SQL Server is not directly network-exposed and all application accounts are tightly scoped reduce the practical attacker population but do not eliminate the vulnerability.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a straightforward network-reachable exploitation path requiring only a low-privilege database credential - a condition met by any application service account or developer login. The attack complexity is low, meaning no race conditions or non-default configurations are required beyond holding a valid login. The full C:H/I:H/A:H triad indicates that successful privilege escalation yields read and write access to all database data and potential availability impact. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, which moderates the immediacy of mass exploitation risk. EPSS data is not provided in the input. The broad scope of affected versions - spanning four major SQL Server releases across both CU and GDR servicing tracks - means the exposure surface is large in any environment that has not yet applied July 2026 patches; even moderately sized deployments with a large authenticated user base (application accounts, reporting users, or developer access) represent meaningful risk if unpatched.

An attacker with a low-privilege SQL Server login - such as a compromised application service account, a developer credential, or a shared reporting account - sends a crafted SQL query that exploits the injection flaw within SQL Server's engine to execute commands in a higher-privilege context. This does not require any special feature to be enabled or any administrative interaction. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity means a working exploit would be straightforward to develop once an analyst identifies the specific injectable execution path.