CVE-2026-65669 – Microsoft SQL Server Elevation of Privilege Vulnerability
CVSS 9.6
CRITICAL
Critical - Same Day Deployment
“A crafted SQL Copilot instruction could turn read-only access into the ability to reach or change sensitive database data.”
CVE-2026-65669 is an elevation-of-privilege vulnerability involving improper neutralization of special elements in output used by a downstream component. An unauthorized attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and access or modify database data with the connected user’s permissions.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-74
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.