CVE Intelligence
Analysis AI-assisted

CVE-2026-65669: Microsoft SQL Server Management Studio Injection Elevation of Privilege Vulnerability

CVE-2026-65669 is a critical injection weakness (CWE-74) in Microsoft SQL Server, as described in the record, which may allow an unauthorized network attacker to elevate privileges. The affected products listed in the record are SQL Server Management Studio 22 releases from 22.0 up to before 22.8.2. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Microsoft published an advisory for CVE-2026-65669, an injection weakness classified as CWE-74 (Injection). The record describes it as improper neutralization of special elements in output used by a downstream component in SQL Server, allowing an unauthorized attacker to elevate privileges over a network. The affected products in the record are SQL Server Management Studio releases. Refer to the MSRC update guide for the vendor's authoritative details.

Impact

  • The record assigns CVSS 3.1 base score 9.6 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. This indicates network attack vector, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity and availability.
  • Two providers in the record report the same score: secure@microsoft.com and microsoft.
  • The SSVC data in the record lists technical impact as total.

Affected products and versions

  • Microsoft SQL Server Management Studio: from 22.0 up to before 22.8.2.
  • Microsoft SQL Server Management Studio 22: from 22.0 up to before 22.8.2.
  • The record's description refers to SQL Server, while the listed affected products are Management Studio. Confirm the exact scope against the MSRC advisory.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • The record gives SSVC exploitation as none and automatable as no. The EPSS probability is 0.00863 with percentile 0.58218, dated 2026-10-23.

Remediation and mitigation

  • Apply the vendor patch referenced in the record. Because the affected range ends before 22.8.2, updating to 22.8.2 or a later release is the likely remediation path (inference; verify against MSRC).
  • Inventory all workstations and servers where SQL Server Management Studio 22 is installed and record their versions.
  • Limit who can reach and use administrative tooling and database accounts until updates are applied, following the principle of least privilege.

Detection guidance

  • Review software inventories for SSMS versions below 22.8.2 in the affected range.
  • Monitor database and host logs for unexpected privilege changes, unusual administrative activity, or unexpected elevated sessions.
  • Correlate alerts with asset ownership so that remediation can be prioritized on systems that accept network connections from less trusted segments.

Limitations of the available information

  • The record does not describe the specific vulnerable component, the injection vector, or the conditions required for exploitation beyond the CVSS vector.
  • The description and the affected product list refer to different scopes (SQL Server and Management Studio), which the record does not resolve.
  • The fixed version is not stated explicitly; 22.8.2 is inferred from the upper bound of the affected range.
  • No exploit details, proof-of-concept or third-party analysis were available in the record.

Frequently asked questions

Is CVE-2026-65669 known to be exploited in the wild?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00863.

Which versions are affected?

The record lists SQL Server Management Studio and Management Studio 22 from 22.0 up to before 22.8.2.

What is the severity?

The record gives a CVSS 3.1 base score of 9.6, rated critical, with a network attack vector and no privileges required.

What should administrators do first?

Inventory SSMS installations, apply the vendor update referenced by MSRC, and verify the fixed version against the advisory, since the record does not state it explicitly.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.