Microsoft SQL Server EUVD-2026-73783

Exploitation requires a valid SQL Server login at low privilege level (PR:L) - an account with at least basic connection rights to the instance. Network access to the SQL Server service (typically TCP 1433) is required. No special configuration, non-default settings, or user interaction is needed beyond possessing a database account. The primary limiting factor is the authentication requirement: unauthenticated external attackers cannot exploit this directly and must first obtain SQL Server credentials through a separate vector such as credential theft, phishing, or exposed application configuration. The vulnerability affects all supported SQL Server versions (2017-2025) in default configurations once a valid login exists.

The CVSS 8.8 score is well-supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: a low-privilege SQL Server account holder can reliably exploit this over the network with no user interaction and no special configuration, achieving full database-tier compromise. The low attack complexity (AC:L) indicates no race conditions or precise timing is required, making the exploitation pathway repeatable and potentially automatable once credentials are available. No EPSS score is provided in the available data, and the vulnerability is not listed in CISA KEV, nor is any public POC or exploit code known at time of analysis, so exploitation appears theoretical or opportunistic rather than confirmed active. Even a mid-sized IT team managing SQL Server infrastructure in malbork should treat this as urgent, because low-privilege SQL Server credentials are routinely exposed through application connection strings, phishing, or prior lateral movement - the PR:L barrier is the primary mitigation, not a strong one in practice. The S:U (unchanged scope) limits blast radius to the SQL Server instance itself, but given C:H/I:H/A:H, full database compromise is the realistic outcome of successful exploitation.

An attacker who has obtained a low-privilege SQL Server login - through a leaked application connection string, a phishing campaign targeting a database user, or credential reuse from a prior breach - connects to the SQL Server instance over the network and issues crafted requests that exploit the insufficient access control granularity to cross privilege boundaries. The attacker escalates to a higher-privileged role, gaining the ability to read all database contents, modify or delete data, or disrupt service availability. No public POC is known at time of analysis, so exploitation likely requires independent vulnerability research or access to private tooling.