Microsoft SQL Server CVE-2026-68778

Exploitation requires a valid SQL Server account with at minimum low privileges (login credentials sufficient to establish a TDS session). The attack is conducted entirely over the network without requiring physical or local access. No special database roles, stored procedure permissions, or non-default configuration are indicated by the available data. Exploitation is limited by: (1) the attacker must possess or obtain valid SQL Server credentials prior to exploitation; (2) the SQL Server TDS port must be reachable from the attacker's network position; (3) no user interaction or administrator activity is required beyond the initial credential requirement.

The CVSS 6.5 score is consistent with a confidentiality-only impact (C:H/I:N/A:N) requiring low-privilege authentication (PR:L) - this is not a remote unauthenticated flaw. EPSS data is not provided, and the vulnerability is not in CISA KEV, indicating no confirmed widespread exploitation. No public proof-of-concept code is identified. The real-world risk is meaningful for organizations where SQL Server database users are untrusted or where multi-tenant environments grant minimal-privilege accounts to external parties, and even a mid-sized municipal IT team in radom should treat this as urgent given the breadth of affected versions spanning eight distinct servicing tracks. The key limiting factor is the PR:L requirement: an attacker must first obtain valid SQL Server credentials. Insider threat, compromised application service accounts, or credential stuffing against exposed SQL Server instances represent the most plausible attack paths.

An attacker with a valid low-privilege SQL Server login - such as a compromised application service account or a read-only reporting user - connects to the SQL Server over the network and issues a crafted query or command that triggers an out-of-bounds read in the server's processing logic. The server returns adjacent memory contents in the response, potentially leaking credential fragments, query results, or internal state from other database sessions. No public exploit code is known to exist at time of analysis.