Microsoft SQL Server EUVD-2026-73814

Exploitation requires a valid SQL Server login with at minimum low (non-administrative) database privileges - PR:L in the CVSS vector confirms authentication is mandatory. The attacker must have network reachability to the SQL Server instance (port 1433 TCP or configured listener). No specific non-default feature or configuration setting is described as a prerequisite beyond holding a valid credential. What limits exploitation: unauthenticated attackers cannot exploit this; the vulnerability is contained to the SQL Server instance (S:U, no scope change to host OS or adjacent systems); and SQL Server 2016 and earlier are not listed as affected, limiting exposure to organizations running 2017 or newer.

CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H presents a high-priority remediation target for organizations running multi-tenant SQL Server instances, shared database infrastructure, or environments where external or minimally-trusted accounts hold SQL logins. Attack complexity is low and requires only a valid low-privilege SQL Server credential - a common condition in development environments, SaaS backends, and shared hosting scenarios. EPSS data was not provided, preventing precise exploitation probability estimation. Neither KEV listing nor public POC code was identified, which somewhat reduces immediate urgency compared to actively exploited SQLi flaws. However, SQL Server's enterprise ubiquity and the low exploitation barrier (authenticated, low-priv, no UI) make this a realistic threat model for insider threats and credential-compromised scenarios. The S:U (unchanged scope) designation limits blast radius to the SQL Server instance itself rather than adjacent systems, but C:H/I:H/A:H on a database engine implies potential for full data exfiltration, data tampering, and service disruption within that instance.

An attacker who has obtained a low-privilege SQL Server login - through credential theft, phishing, or insider access - connects to the SQL Server instance over the network and submits a specially crafted SQL statement that exploits the injection flaw within the engine. The injected payload manipulates SQL command evaluation to elevate the attacker's effective database permissions, granting access to data or operations reserved for higher-privilege roles. No public exploit code was identified at time of analysis, but the low attack complexity suggests weaponization would be straightforward once the precise injection point is reverse-engineered from the patch.