CVE-2026-65669
Critical9.6SQL Server Management Studio 22: Microsoft SQL Server Elevation of Privilege Vulnerabilitytitle from the CVE record
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
- CVSS
- 9.6v3.1
- EPSS (exploit probability)
- 0.9%58th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-26 | 0.9% | 58.3% |
| 2026-10-25 | 0.9% | 58.3% |
| 2026-10-24 | 0.9% | 58.3% |
| 2026-10-23 | 0.9% | 58.2% |
| 2026-10-22 | 0.9% | 58.2% |
| 2026-10-21 | 0.9% | 58.1% |
| 2026-10-20 | 0.9% | 57.9% |
| 2026-10-19 | 0.9% | 57.9% |
| 2026-10-18 | 0.9% | 57.9% |
| 2026-10-17 | 0.9% | 57.9% |
| 2026-10-16 | 0.9% | 57.8% |
| 2026-10-15 | 0.9% | 57.8% |
| 2026-10-14 | 0.9% | 57.7% |
| 2026-10-13 | 0.9% | 57.5% |
| 2026-10-12 | 0.9% | 57.5% |
| 2026-10-11 | 0.9% | 57.4% |
| 2026-10-10 | 0.9% | 57.4% |
| 2026-10-09 | 0.9% | 57.4% |
| 2026-10-08 | 0.9% | 57.3% |
| 2026-10-07 | 0.9% | 57.9% |
| 2026-10-06 | 0.9% | 57.8% |
| 2026-10-05 | 0.9% | 57.8% |
| 2026-10-04 | 0.9% | 57.8% |
| 2026-10-03 | 0.9% | 57.8% |
| 2026-10-02 | 0.9% | 57.7% |
| 2026-10-01 | 0.9% | 57.7% |
| 2026-09-30 | 0.9% | 57.6% |
| 2026-09-29 | 0.9% | 57.6% |
| 2026-09-27 | 0.9% | 57.5% |
| 2026-09-26 | 0.9% | 57.5% |
| 2026-09-25 | 0.9% | 57.4% |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Learn
Why it happened and what stops it
How attackers use it (ATT&CK)
Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.
How it's exploited
What the attacker gets
What they do next
Controls that mitigate it (NIST SP 800-53)
- CM-6Configuration SettingsConfiguration Management · mitigates 6 of these techniques
- SI-4System MonitoringSystem and Information Integrity · mitigates 6 of these techniques
- AC-3Access EnforcementAccess Control · mitigates 5 of these techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 of these techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 5 of these techniques
- SI-10Information Input ValidationSystem and Information Integrity · mitigates 5 of these techniques
Affected products
- microsoft sql server management studio