Microsoft SQL Server EUVD-2026-100709

Exploitation requires the attacker to already possess a valid, low-privileged SQL Server login or principal (CVSS PR:L) - this is NOT remotely exploitable by an anonymous/unauthenticated attacker. The affected component is the SQL Server database engine itself (versions below the patched builds: SQL Server 2017 GDR <14.0.2140.2 / CU31 <14.0.3560.2, 2019 GDR <15.0.2200.2 / CU32 <15.0.4500.2, 2022 GDR <16.0.1210.3 / CU27 <16.0.4305.5, and 2025 GDR <17.0.1145.4 / CU9 <17.0.5015.4). No end-user interaction is needed (UI:N). The primary LIMITING factors are: (1) mandatory authenticated access to the SQL Server instance, and (2) high attack complexity (AC:H), implying the attacker must satisfy a hard-to-control condition such as a specific heap state or race, reducing reliability and preventing automated/scalable exploitation (SSVC Automatable: no). No specific non-default feature or configuration flag is named in the description as a prerequisite.

This is a legitimate but not top-tier emergency priority. The CVSS 3.1 base score of 8.5 (High) is driven by network reach (AV:N), a scope change (S:C), and total impact on confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating. However, several signals temper the raw score: exploitation requires high attack complexity (AC:H) and existing low-level privileges (PR:L), meaning the attacker must already be an authenticated SQL Server principal and must win a non-trivial condition (typical of heap-overflow race/layout dependencies). CISA's SSVC framework reinforces this restraint - Exploitation is rated 'none' and Automatable 'no', indicating no observed exploitation and no reliable, scalable attack path. There is no CISA KEV listing and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. No public exploit code was identified at time of analysis. Net assessment: a credible privilege-escalation flaw in a high-value data platform that warrants prompt patching, but the authentication requirement plus high complexity and absence of any exploitation evidence place it below internet-facing, unauthenticated-RCE urgency. The one point worth verifying with Microsoft is the S:C (scope change): the description frames this as privilege elevation 'over a network' by an already-authorized attacker, and whether code execution escapes the SQL Server security authority to the host OS determines how much of the 8.5 is justified.

An attacker who already holds a low-privileged SQL Server login (e.g. a compromised application service account or an abusive internal user) sends specially crafted input to the SQL Server engine over the network to corrupt heap memory. By grooming the heap and triggering the overflow (a high-complexity step), they overwrite control data to execute code or escalate to a higher-privileged context such as the SQL Server service account. No public proof-of-concept was identified at time of analysis.