CVE-2026-65669 – Microsoft SQL Server Elevation of Privilege Vulnerability

CVE-2026-65669 is an elevation-of-privilege vulnerability involving improper neutralization of special elements in output used by a downstream component. An unauthorized attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and access or modify database data with the connected user’s permissions.

CVSS SCORE: 9.6.

SEVERITY: Critical.

THREAT: The vulnerability can be reached over a network, has low attack complexity, and requires no attacker privileges. User interaction is required for exploitation. A successful attack can have a high impact on confidentiality, integrity, and availability, with the security scope changing as part of exploitation.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-65669 is caused by improper neutralization of special elements in output used by a downstream component, categorized as CWE-74 injection. An attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and cause database operations to occur using the connected user’s permissions. This may allow unauthorized access to or modification of database data. The attack vector is network-based, attack complexity is low, no attacker privileges are required, and user interaction is required.

EXPLOITABILITY: SQL Server Management Studio 22 is affected. Exploitation requires an attacker to convince a user to submit specially crafted instructions to SQL Copilot. No attacker privileges are required, but user interaction is necessary.

BUSINESS IMPACT: Successful exploitation could undermine database access controls and expose organizations to unauthorized data access or modification. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could affect sensitive information, business-critical records, and the reliability of database-backed operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.6. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for high confidentiality, integrity, and availability impact make prompt deployment of the official fix important, even though exploitation is currently assessed as Less Likely.