EUVD-2026-73320
GHSA-mqmp-r7vg-2hph
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote injection needing victim interaction with attacker-supplied output (UI:R); no auth on the client (PR:N); scope change and full C/I/A on the compromised host justify S:C and H impacts.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft SQL Server Management Studio (SSMS) 22 before 22.8.2 lets a remote attacker inject unneutralized special elements into output processed by a downstream component, escalating privileges over the network when a user is induced to interact (UI:R). Although the NVD description names 'SQL Server,' the EUVD affected-product list scopes the flaw to the SSMS client tool, indicating a client-side injection rather than a database-engine defect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to run SQL Server Management Studio 22 (before 22.8.2) and to interact with attacker-controlled content - the CVSS vector's UI:R confirms user interaction is mandatory, so this is not a fully automatable remote attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) rates this critical, but the AV:N/PR:N pairing must be read alongside UI:R and the SSMS client scoping: exploitation is not a spray-able server-side attack - it requires a targeted user to interact, typically by connecting SSMS to or processing output from an attacker-influenced source. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading SQL Server Management Studio to 22.8.2 or later (Vendor-released patch: SSMS 22.8.2), per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all SSMS 22.x installations, prioritizing database administrator workstations, and inventory current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today