Microsoft SQL Server EUVD-2026-73301

Exploitation requires a valid SQL Server login with at minimum low-level privileges (PR:L) - anonymous or unauthenticated access is not sufficient. The attacker must be able to reach the SQL Server listener over a network (AV:N), typically TCP port 1433 or a configured non-default port. High attack complexity (AC:H) means the attacker must craft a precise payload to overcome Windows exploit mitigations (ASLR, DEP/NX) - this is not a point-and-click exploit. No specific non-default feature or configuration is identified as a prerequisite beyond network connectivity and a valid credential. Limiting factors for defenders: restricting SQL Server to private/internal-only network segments removes the network vector; enforcing strong credential hygiene and minimizing the number of accounts with direct SQL access reduces the authenticated-attacker pool.

The CVSS 8.5 score with S:C and C:H/I:H/A:H represents a serious but not trivially exploited vulnerability. The PR:L requirement confirms that an authenticated SQL Server login is a prerequisite, which substantially limits the attack surface relative to unauthenticated network exposure. AC:H further reduces real-world exploitation probability, as an attacker must precisely control memory layout and bypass Windows exploit mitigations. EPSS data is not provided; without it, quantitative exploitation probability cannot be stated. The vulnerability is not in the CISA KEV catalog and no POC has been identified, suggesting opportunistic mass exploitation is not currently occurring. Internet-exposed SQL Server instances with weak credential hygiene remain the primary concern - credential compromise followed by this exploit represents the most plausible escalation path. Organizations with SQL Server accessible only via private network segments face materially lower risk, but the scope change means even internal exploitation could lead to full host compromise.

An attacker who has obtained a low-privilege SQL Server login - through credential stuffing, phishing, or lateral movement - connects to the database engine over TCP and sends a specially crafted network payload targeting a vulnerable stack buffer in a reachable SQL Server code path. Exploiting the overflow requires careful heap and stack layout manipulation to defeat ASLR and DEP, reflecting the AC:H complexity. If successful, the attacker achieves arbitrary code execution under the SQL Server service account, with scope change enabling potential escalation to OS-level access on the host.