Microsoft SQL Server EUVD-2026-73180

The attacker must possess a valid, authenticated low-privilege SQL Server login (PR:L per CVSS) and network connectivity to the SQL Server instance (AV:N). The ability to create symbolic links or NTFS junction points in a filesystem location that SQL Server's service account traverses during normal file operations is a likely prerequisite; this typically requires the attacker to have OS-level write access to a writable directory within the SQL Server data, temp, or backup paths, which may be obtainable via the SQL login itself (e.g., through xp_cmdshell if enabled, or via BULK INSERT staging paths). No elevated SQL privileges beyond a basic authenticated login appear necessary per the CVSS vector (PR:L). No user interaction is required (UI:N). No non-default SQL Server configuration is explicitly stated as a prerequisite in the available description, meaning any SQL Server installation on an affected version with at least one low-privilege login is potentially targetable. The scope is bounded to the SQL Server host (S:U).

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic and serious threat profile: network-accessible exploitation requiring only a valid low-privilege SQL Server login, no user interaction, and low attack complexity, yielding full confidentiality, integrity, and availability impact after privilege escalation. The low complexity metric is particularly notable - it suggests no race conditions, special timing requirements, or unusual environmental dependencies. No EPSS score was provided in the input, and the vulnerability is not currently listed in the CISA KEV catalog, so exploitation is assessed as no public exploit identified at time of analysis; however, the breadth of affected versions (2017 through 2025) and the low barrier to exploitation mean that even a mid-sized municipal IT team in leszno should treat this as urgent given the likely density of SQL Server deployments in their environment. The S:U (scope unchanged) metric suggests the privilege escalation is bounded to the SQL Server host, not an adjacent network scope change, but C:H/I:H/A:H on that host still represents full system compromise.

An attacker holding a low-privilege SQL Server login - for example, a developer account or a compromised application service credential - creates an NTFS junction or symbolic link on the server file system pointing from a path SQL Server is known to access (such as a temp directory or a backup staging location) to a sensitive system resource like SAM hive files or critical configuration data. When SQL Server resolves this link while executing a file-handling operation under its high-privilege service account, the attacker gains unauthorized read or write access to the targeted resource, achieving effective OS-level privilege escalation. No public exploit code has been identified at time of analysis, but the technique is well-understood in the Windows symlink abuse literature, making independent rediscovery feasible.