Microsoft SQL Server EUVD-2026-73786

Exploitation requires a valid SQL Server credential with at minimum low-level database access (PR:L). The attacker must have network reachability to the SQL Server listener, typically TCP 1433. No special database configuration, feature flag, or elevated starting role is indicated as required beyond baseline authentication. Limiting factors: the attacker must first obtain a SQL Server login, which is not trivially available without prior credential compromise or weak password configurations; unauthenticated exploitation is not possible. Organizations enforcing strict SQL login provisioning, using Windows Integrated Authentication only, and firewalling direct SQL port access reduce exposure substantially.

CVSS 8.8 with a network vector, low complexity, and no user interaction places this firmly in the high-priority tier. The PR:L requirement means exploitation is bounded by the need for any valid SQL Server credential - a significant but not uncommon attacker position in enterprise environments where SQL accounts are broadly provisioned. The full C:H/I:H/A:H impact triad indicates that successful exploitation grants complete control over affected database server resources. No EPSS or KEV data was provided in the input; EPSS cannot be inferred, and the absence from CISA KEV means confirmed active exploitation is not established at this time. The broad version coverage - four major release families across eight servicing branches - substantially widens the affected footprint. Given SQL Server's prevalence in enterprise data tiers, this should be treated as a high operational priority even without confirmed active exploitation.

An attacker who has obtained a low-privilege SQL Server login - for example, through credential stuffing, phishing, or a breached application service account - connects to the SQL Server listener over the network and issues a crafted request that exploits the improper access control boundary. The server fails to enforce the privilege check and elevates the attacker's session to a higher-privilege role, granting full read/write/administrative access to databases and potentially the underlying OS via features such as xp_cmdshell. No public exploit code has been identified at time of analysis.