CVE-2026-66814

CVE-2026-66814 is a privilege-escalation vulnerability (CWE-1220, insufficient granularity of access control) in Microsoft SQL Server, rated 8.8 High with a network attack vector. A remote attacker who already holds a low-privileged, authorized account can send network requests to the database and, because access-control granularity is too coarse, obtain rights beyond those granted; no user interaction or special conditions are required. Successful exploitation carries high-impact consequences for confidentiality, integrity, and availability of the affected instance, effectively allowing the attacker to operate with elevated privileges. Any organization running an affected SQL Server build is exposed, especially where the database is reachable over the network by non-administrator accounts. Exploitation status is currently quiet: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns only a 0.4% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for CVE-2026-66814 from Microsoft's advisory as soon as your SQL Server version branch is confirmed affected (version details were not included in this data). Until patched, restrict network access to SQL Server to trusted hosts and service accounts, and audit low-privileged logins for unexpected granted permissions or activity.