What is the CVSS score of EUVD-2026-73378?

EUVD-2026-73378 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft SQL Server are affected by EUVD-2026-73378?

Microsoft SQL Server versions 2017-2025 contain a privilege escalation vulnerability allowing authenticated database users with limited permissions to elevate to administrative access levels.. A patch is available.

How to fix or mitigate EUVD-2026-73378?

Within 24 hours, conduct a complete inventory of all SQL Server 2017-2025 instances across your environment (on-premises, Azure SQL, and hybrid deployments) and document current patch levels. Within 7 days, apply Microsoft's released patch to all production SQL Server instances after testing in non-production environments to validate application compatibility; prioritize systems with sensitive data or elevated user access requirements. Within 30 days, complete patch deployment across all SQL Server environments including staging and development systems, review database user role assignments to enforce least-privilege access principles, and verify patch compliance across the entire SQL Server estate.

Microsoft SQL Server EUVD-2026-73378

| CVE-2026-66820 HIGH

SQL Injection (CWE-89)

2026-09-08 secure@microsoft.com

GHSA-wccj-w6f2-7r8j

SQLi Microsoft

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-reachable SQL Server, low-privilege auth required (PR:L), no interaction needed, privilege escalation yields full C/I/A compromise within the database scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 08, 2026 - 20:40 vuln.today

tag: Microsoft added

Analysis Generated

Sep 08, 2026 - 20:32 vuln.today

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid SQL Server login with at least low-level (non-guest) authentication credentials (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 rating is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and full C/I/A impact (S:U, C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Microsoft-released patches for the appropriate servicing branch: SQL Server 2017 CU31 → upgrade to 14.0.3550.4 or later; SQL Server 2017 GDR → upgrade to 14.0.2130.4 or later; SQL Server 2019 CU32 → upgrade to 15.0.4490.9 or later; SQL Server 2019 GDR → upgrade to 15.0.2190.7 or later; SQL Server 2022 CU26 → upgrade to 16.0.4275.2 or later; SQL Server 2022 GDR → upgrade to 16.0.1200.5 or later; SQL Server 2025 CU8 → upgrade to 17.0.4085.5 or later; SQL Server 2025 GDR → upgrade to 17.0.1135.8 or later. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all SQL Server 2017-2025 instances across your environment (on-premises, Azure SQL, and hybrid deployments) and document current patch levels. …

Threat intelligence, references, and detailed analysis are available after sign-in.