EUVD-2026-73786
GHSA-ch5f-9v66-h8x4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable with only a valid low-privilege SQL login; no complexity beyond authentication; full triad impact consistent with privilege escalation to database admin.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft SQL Server (2017 through 2025) allows a low-privileged authenticated network attacker to gain full administrative control via improper access control enforcement. The vulnerability spans four major SQL Server release trains - 2017, 2019, 2022, and 2025 - including both Cumulative Update (CU) and General Distribution Release (GDR) servicing branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server credential with at minimum low-level database access (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with a network vector, low complexity, and no user interaction places this firmly in the high-priority tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released patches corresponding to each affected servicing branch: SQL Server 2017 CU 31 users should upgrade to 14.0.3550.4 or later; SQL Server 2017 GDR users to 14.0.2130.4 or later; SQL Server 2019 CU 32 users to 15.0.4490.9 or later; SQL Server 2019 GDR users to 15.0.2190.7 or later; SQL Server 2022 CU 26 users to 16.0.4275.2 or later; SQL Server 2022 GDR users to 16.0.1200.5 or later; SQL Server 2025 CU8 users to 17.0.4085.5 or later; and SQL Server 2025 GDR users to 17.0.1135.8 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SQL Server 2017, 2019, 2022, and 2025 instances across your environment and document current patch levels; review access logs for any suspicious privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today