Microsoft SQL Server CVE-2026-67383

Exploitation requires a valid SQL Server login credential with at minimum public or guest-level permissions (PR:L). The attacker must have network-level access to the SQL Server TDS port (default TCP 1433). The vulnerability is triggered by crafting queries or operations that cause the SQL Server engine to generate error responses containing sensitive data. No special configuration, elevated role, or non-default feature needs to be enabled. Exploitation is limited by the credential requirement - unauthenticated attackers cannot exploit this directly. Internet-exposed SQL Server instances with weak or shared credentials represent the highest-risk deployment pattern.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), which reasonably represents the threat landscape. The attack complexity is low and no user interaction is needed, but PR:L means the attacker must first possess a valid SQL Server credential, which is a meaningful barrier. The C:H rating implies the disclosed information could be highly sensitive - potentially including schema metadata, internal configuration, or data fragments - but the scope is unchanged (S:U), so lateral movement to other systems is not directly implied. No public exploit code has been identified and the vulnerability is not in CISA KEV, so EPSS-implied opportunistic exploitation risk is lower than the CVSS base score alone might suggest. The real-world priority is elevated in environments where SQL Server accounts are shared, weak, or accessible to untrusted internal users, and should be treated as a high-priority patch for internet-exposed or multi-tenant SQL Server deployments.

An attacker who has obtained a low-privilege SQL Server login - via credential stuffing, phishing, or internal access - connects to an affected SQL Server 2025 instance over the network and submits queries or commands designed to trigger specific error conditions. The resulting error messages returned by the server contain sensitive internal data, such as schema names, file paths, or configuration fragments, which the attacker collects to further their reconnaissance or pivot. No public proof-of-concept has been identified, but the AC:L rating indicates exploitation would require minimal technical sophistication once credentials are in hand.