MSRC-CVE-2026-65669 — Microsoft SQL Server Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and allow database data to be accessed or modified using the connected user's permissions. User interaction is required.

Security updates
22.8.2 — https://learn.microsoft.com/ssms/release-notes-22

Vulnerabilities 1

Critical 9.6

CVE-2026-65669

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.

Microsoft SQL Server Management Studio 22

Sep 8, 2026

Revision history

2026-09-08 #1
Information published.

References

CVE-2026-65669 Microsoft SQL Server Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss