Microsoft SQL Server CVE-2026-85888

Exploitation requires an authenticated SQL Server session: the CVSS vector specifies PR:L, so the attacker must hold valid, low-privilege credentials and network connectivity to the database instance - this is NOT an unauthenticated flaw. No user interaction is required (UI:N) and attack complexity is low (AC:L). The description names no special non-default feature or configuration toggle; the out-of-bounds read appears reachable through normal authorized query/request handling against affected builds. Limiting factors: the need for valid database credentials (restricting the attacker pool to existing users or those who can obtain an account, making multi-tenant or shared instances the highest-risk deployments), confidentiality-only impact with no integrity or availability effect, and the requirement that the instance run an unpatched build within the listed version ranges (SQL Server 2017, 2019, 2022, and 2025 GDR/CU branches).

This is a credible mid-tier priority rather than a drop-everything emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms a network-reachable, low-complexity attack requiring an authenticated principal with low privileges, and the impact is confined to confidentiality (C:H/I:N/A:N) - i.e. memory disclosure, consistent with the CWE-125 out-of-bounds read. The scope-changed flag (S:C) is what drives the 7.7 score; this implies the disclosed data can cross a security boundary (e.g. reading memory belonging to another security context within the SQL Server process). Exploitation status: no public exploit identified at time of analysis - there is no EPSS value, no POC indicator, and no CISA KEV listing in the supplied data, so there is no evidence of active exploitation or weaponization. The signals are internally consistent (network + low-priv + confidentiality-only), with no contradiction between the vector and the description. The main caveat is that read-only memory disclosure requiring valid credentials is meaningfully less dangerous than an unauthenticated RCE: an attacker must already be an authorized database user. Note also the scope and C:H rating appear to be the vendor's (Microsoft, the CNA) assessment - a plain authorized-user OOB read disclosing process memory would more typically be rated S:U, so the elevated 7.7 should be treated as the vendor's conservative view.

An authenticated low-privileged SQL Server user (for example a tenant on a shared or multi-tenant database instance) sends a specially crafted query or request that triggers an out-of-bounds read in the server, causing it to return adjacent process memory. The leaked memory could contain data belonging to other sessions or security contexts, such as cached query data, credentials, or other sensitive values. No public exploit code is identified at time of analysis, and the attack requires valid network credentials.