Microsoft SQL Server CVE-2026-73028

The attacker must possess a valid SQL Server login with at minimum public-role or equivalent low-privilege access to the target instance. Exploitation is conducted over a standard network connection to the SQL Server endpoint (default TCP 1433 or named pipes) and requires no user interaction and no elevated roles. SQL Server instances reachable from application tiers, developer workstations, or shared network segments where multiple users hold SQL logins are at greatest risk. Exploitation is bounded by the requirement for at least one valid database credential - unauthenticated network access to port 1433 alone is insufficient. Available data does not indicate that any non-default feature (CLR integration, linked servers, SQL Agent, xp_cmdshell) must be enabled for exploitation; the flaw appears to be in core access-control enforcement applicable to standard authenticated sessions across all affected SQL Server versions.

The CVSS 8.8 score is well-supported: AV:N reflects network exploitation, AC:L indicates no special attack conditions beyond a valid login, PR:L confirms a low-privilege account is required (not unauthenticated), and the C:H/I:H/A:H triad reflects the potential for full database or host-level compromise upon successful privilege escalation. No EPSS score or KEV listing is present in the available intelligence, so exploitation probability cannot be quantified and active in-the-wild exploitation is not confirmed. The 'Authentication Bypass' tag in the input metadata is inaccurate - the CVSS PR:L vector and the description phrase 'authorized attacker' both confirm that a valid credential is required, making this a privilege escalation scenario rather than an authentication bypass. SQL Server instances are high-value targets in enterprise environments given the sensitive data they hold, and a low-privilege insider or a compromised application-tier service account is a realistic initial-access path. Patch coverage spans all current servicing branches (2017 through 2025), so the fix surface is broad and organizations with mixed SQL Server version fleets may need to apply multiple distinct updates. No public exploit has been identified at time of analysis.

An attacker who has obtained a low-privilege SQL Server account - via phishing, credential stuffing against an exposed instance, or compromise of an application service account - connects to TCP 1433 and triggers the access control flaw through a crafted query or API call. The flaw allows the attacker to assume higher database roles or system-level permissions, enabling full database exfiltration or, if xp_cmdshell or CLR is available, operating system command execution on the SQL Server host. No public exploit code has been confirmed at time of analysis, but the low attack complexity (AC:L) means exploitation does not require advanced tradecraft once network access and a low-privilege credential are obtained.