Microsoft SQL Server CVE-2026-67385

Exploitation requires a valid SQL Server login credential - any authenticated database user account suffices, including low-privileged application accounts. No special database roles (such as sysadmin) are required based on PR:L in the CVSS vector. The attacker must have network access to the SQL Server's TCP listener (default port 1433 or named-pipe equivalent). No special non-default configuration or feature enablement is indicated - the vulnerability exists within core SQL Server functionality accessible to any authenticated session. Limiting factors include: the need for at least one valid credential, and network-layer accessibility to the SQL Server instance. Environments using Windows Authentication with Kerberos and network-level firewall segmentation reduce exposure, but do not eliminate it if authenticated sessions are possible from attacker-controlled hosts.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8, reflecting the primary risk correctly: network-reachable exploitation requires only a valid SQL Server credential (PR:L), which is attainable through credential theft, brute force, or insider threat. AC:L indicates the exploit does not require race conditions or special timing. The full C:H/I:H/A:H impact triad means successful exploitation yields full database compromise, data exfiltration capability, and potential denial of service from process crash. No public exploit code has been identified at time of analysis, and EPSS data is not present in the source intelligence, limiting probabilistic assessment. However, SQL Server is a high-value enterprise target and UAF primitives in mature software are historically weaponizable given sufficient research effort. The 'Denial Of Service' tag in the source metadata understates the impact - the description explicitly states code execution, not just availability loss. Real-world risk is elevated by the breadth of affected versions (four major releases, both servicing channels) and the low privilege barrier.

An attacker who has obtained a low-privileged SQL Server account - through credential phishing, password spray against the SQL Server listener, or compromising an application service account - sends a specially crafted query or connection sequence over TCP port 1433 that triggers a use-after-free condition in the SQL Server engine. The resulting heap corruption allows the attacker to redirect code execution within the SQL Server process, achieving full read/write access to the database and potentially executing OS-level commands depending on the SQL Server service account's privileges. No public proof-of-concept code has been identified at time of analysis, so practical exploitation likely requires meaningful reverse-engineering effort.