CVE-2026-66819

CVE-2026-66819 is a SQL injection vulnerability (CWE-89) in Microsoft SQL Server caused by improper neutralization of special elements used in SQL commands. An attacker holding valid low-privileged credentials can send crafted SQL input over the network, causing the database engine to execute attacker-controlled SQL. Successful exploitation elevates the attacker's privileges within SQL Server, with high impact on confidentiality, integrity, and availability reflected in the 8.8 (high) CVSS 3.1 score. Organizations running Microsoft SQL Server where low-privileged accounts can authenticate over the network are affected; the available data does not specify exact affected version ranges, so the Microsoft advisory should be consulted. No public proof-of-concept or confirmed in-the-wild exploitation is known: the flaw is not in CISA KEV, and EPSS assigns a 0.7% (52nd percentile) probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for CVE-2026-66819 per the vendor advisory, matching the correct update to your SQL Server version and servicing branch. Until patched, restrict inbound SQL Server network access (default TCP 1433) to trusted hosts and networks, audit low-privileged logins for least privilege, and avoid exposing SQL Server directly to the internet. Monitor Microsoft advisories and threat feeds for emergence of a public PoC or in-the-wild exploitation.