Microsoft has disclosed CVE-2026-65669, a CVSS 9.6 critical injection vulnerability in SQL Server Management Studio 22 that allows an unauthenticated, network-based attacker to elevate privileges.
What Is It
CVE-2026-65669 is an improper neutralization of special elements in output used by a downstream component, an injection flaw (CWE-74), in Microsoft SQL Server Management Studio. Per Microsoft's advisory, the weakness "allows an unauthorized attacker to elevate privileges over a network."
The vulnerability carries a CVSS 3.1 base score of 9.6 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The record was published 2026-09-08 by Microsoft ([email protected]) and remains in "Awaiting Analysis" status at NVD.
Why It Matters
The metrics tell the story. Attack vector is network, attack complexity is low, and no privileges are required: an attacker needs no foothold or credentials to begin. Impact is high across confidentiality, integrity, and availability, and the scope is changed, meaning successful exploitation reaches beyond the vulnerable component itself into other resources.
The one mitigating factor is that user interaction is required. An attacker must get a target to take some action, which puts this in phishing and social-engineering territory rather than fully autonomous remote exploitation. That caveat does not lower the ceiling much: SSMS is an administrative tool, and the operators running it typically hold elevated database access worth stealing.
CVE-2026-65669 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, so active exploitation in the wild is not confirmed at this time.
What's Vulnerable
Per Microsoft's affected-product data:
- Microsoft SQL Server Management Studio 22, versions 22.0 up to (but not including) 22.8.2
No CPE entries have been assigned yet, and no other products are listed in the advisory.
Patch Status
The version data indicates SSMS 22.8.2 is the fixed release; installations at 22.0 through 22.8.1 are affected. Administrators should consult the MSRC update guide entry for the specific update package and upgrade SSMS installations to 22.8.2 or later. No federal remediation deadline applies, as the CVE is not listed in the CISA KEV catalog.
Sources
- Microsoft Security Response Center (MSRC) Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669
- NIST National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-65669
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog