AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-66820

Microsoft SQL Server: SQL injection

Microsoft

CVE-2026-66820 · Published Sep 8, 2026 · updated Sep 16, 2026

High8.8
Fix: upgrade to 14.0.3550.4 or later (8 fixed versions below)
Microsoft advisory

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected versions

PackageAffectedFixed in
Microsoft SQL Server 2017 (CU 31)
Product
>= 14.0.0, < 14.0.3550.414.0.3550.4
Microsoft SQL Server 2017 (GDR)
Product
>= 14.0.0, < 14.0.2130.414.0.2130.4
Microsoft SQL Server 2019 (CU 32)
Product
>= 15.0.0.0, < 15.0.4490.915.0.4490.9
Microsoft SQL Server 2019 (GDR)
Product
>= 15.0.0, < 15.0.2190.715.0.2190.7
Microsoft SQL Server 2022 (CU 26)
Product
>= 16.0.0.0, < 16.0.4275.216.0.4275.2
Microsoft SQL Server 2022 (GDR)
Product
>= 16.0.0, < 16.0.1200.516.0.1200.5
Microsoft SQL Server 2025 (CU8)
Product
>= 17.0.0.0, < 17.0.4085.517.0.4085.5
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Product
>= 17.0.1050.2, < 17.0.1135.817.0.1135.8
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-89

More Microsoft advisories

All Microsoft
High 8.3Sep 8Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2High 7.1Sep 8Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2High 7.5Sep 8Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2