CVE-2026-66820

CVE-2026-66820 is an SQL injection flaw (CWE-89) in Microsoft SQL Server in which special elements used in SQL commands are not properly neutralized. An attacker who already holds low-privileged, authorized credentials can send specially crafted input over the network that is incorporated into a SQL command and executed in a more privileged context, with no user interaction required. Successful exploitation results in elevation of privilege on the database server, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High). Any organization running affected Microsoft SQL Server builds is potentially affected, particularly where low-privileged or untrusted users can reach the database service over the network. As of the available data there is no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.5% probability of exploitation within 30 days.

What to do: Check Microsoft's security advisory (MSRC) for the list of affected SQL Server builds and apply the corresponding security update as soon as it is available. Until patched, restrict network access to SQL Server (avoid exposing port 1433 directly to the internet), apply least privilege to low-privileged accounts, and review database role memberships and audit logs for unexpected privilege changes, since the flaw lets authorized users elevate their rights.