CVE-2026-65669

Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched).

What to do: Apply the SQL Server security updates from Microsoft's September 2026 Patch Tuesday as soon as practical, prioritizing internet-exposed instances and servers that accept untrusted input whose output feeds downstream components. With no public PoC or KEV listing, near-term risk appears low, but re-prioritize if technical details or exploit code emerge. Verify deployed SQL Server builds against Microsoft's advisory for CVE-2026-65669 to confirm remediation.