CVE-2026-65669: Critical SQL Server Injection Vulnerability (CVSS 9.6) — Detection, Hardening, and Remediation Guide

The National Vulnerability Database has published CVE-2026-65669, a CRITICAL (CVSS 9.6) injection vulnerability in Microsoft SQL Server — one of the most widely deployed relational database engines on the planet. Per the NVD record, the flaw stems from improper neutralization of special elements in output used by a downstream component (CWE-74, 'Injection') and allows an unauthorized attacker to elevate privileges over the network.

Read that again from a defender's seat: no authentication required, network-reachable, privilege elevation, on a platform that typically holds the crown jewels — customer PII, financial records, HIPAA-regulated data, and authentication secrets for downstream applications. If SQL Server is reachable from an attacker's position on the network, this vulnerability is a direct path from unauthenticated access to privileged database control, and in most environments, privileged database control is one misconfigured xp_cmdshell or over-privileged service account away from full host compromise.

Bottom line: treat this as an emergency patch candidate. Inventory every SQL Server instance (including the forgotten Express and LocalDB installs), verify network exposure of TCP 1433/UDP 1434, and stage the Microsoft security update immediately.

Technical Analysis

Affected Products

• Microsoft SQL Server — consult the NVD CPE configuration list and Microsoft's Security Update Guide entry for CVE-2026-65669 for the exact affected branches and builds. Historically, SQL Server CVEs of this class span all supported major versions (2016 SP3, 2017, 2019, 2022) across both GDR and CU servicing trains.
• Don't forget embedded deployments: SQL Server Express bundled with line-of-business applications, LocalDB on endpoints, and SQL Server instances running under third-party backup, monitoring, and ERP software are frequently missed in patch sweeps.

Vulnerability Classification

How the Vulnerability Works (Defender's Perspective)

CWE-74 in a database engine context means attacker-controlled input is embedded into a data stream consumed by a downstream component without proper neutralization of metacharacters. In SQL Server, the practical exploitation chain for this bug class typically looks like:

1. Network reachability — the attacker sends crafted input to a listening SQL Server endpoint (TCP 1433, or indirectly through an application tier that passes unsanitized input to the engine).
2. Injection into downstream processing — specially formed elements escape their intended data context and are interpreted by a privileged downstream component inside the SQL Server process space.
3. Privilege elevation — the attacker escalates from no credentials to an authenticated/privileged security context inside the database engine (e.g., sysadmin-equivalent or execution under the SQL Server service account).
4. Post-exploitation pivot — once privileged inside the engine, the standard playbook is enabling xp_cmdshell or OLE Automation to execute OS commands, staging payloads via certutil/PowerShell, dumping credentials from the service account, and pivoting laterally — often via the same SMB/Kerberos infrastructure the database server trusts.

The exploitation requirement that matters most to you is the first one: network reachability. Internet-exposed SQL Server instances (still shockingly common per public scan data) are the highest-risk population. Internal instances reachable from user VLANs are second.

Exploitation Status

At the time of writing, CVE-2026-65669 is published in NVD; verify current status against CISA's Known Exploited Vulnerabilities (KEV) catalog daily — CVSS 9.6 network-exploitable, unauthenticated privilege-elevation bugs in enterprise products have historically moved from disclosure to weaponization in days, not months. Assume motivated actors are reversing the patch the moment it ships.

Detection & Response

Because pre-exploitation traffic for an engine-internal injection flaw is difficult to signature without deep protocol inspection, the highest-fidelity detections focus on post-exploitation behavior: SQL Server spawning child processes, abuse of dangerous stored procedures, and unexpected database service account activity. These behaviors are loud, low-noise, and catch this CVE plus the entire class of SQL Server privilege-escalation attacks.

SIGMA Rules

---
title: SQL Server Process Spawning Command Shell or Script Interpreter
id: 8f2c4d61-3b7a-4e9c-a1d5-6f8e2b4c9d01
status: experimental
description: Detects sqlservr.exe spawning command shells, script interpreters, or LOLBins. Consistent with post-exploitation after SQL Server privilege escalation (e.g., CVE-2026-65669) where attackers enable xp_cmdshell or OLE Automation to execute OS commands. Legitimate sqlservr.exe almost never spawns these children.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65669
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare third-party SQL Server monitoring or maintenance tools executing scripts under the engine context
  - Legitimate SQL Agent jobs calling cmdexec steps (these spawn under sqlagent.exe, not sqlservr.exe — verify parent)
level: high
---
title: SQL Command-Line Client Invoking Dangerous Stored Procedures
id: 4a1e7b92-5d3f-4c8a-b6e2-9d1f3a7c5e08
status: experimental
description: Detects sqlcmd.exe or osql.exe execution referencing xp_cmdshell, sp_configure, OLE Automation, or ad hoc distributed queries. Attackers who elevate privileges via flaws like CVE-2026-65669 commonly enable these features to pivot from database access to host command execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65669
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\sqlcmd.exe'
      - '\osql.exe'
  selection_cmd:
    CommandLine|contains:
      - 'xp_cmdshell'
      - "sp_configure 'xp_cmdshell'"
      - 'Ole Automation Procedures'
      - 'Ad Hoc Distributed Queries'
      - 'OPENROWSET'
      - 'xp_dirtree'
  condition: selection_image and selection_cmd
falsepositives:
  - DBAs performing legitimate maintenance — baseline and allowlist known admin workstations and accounts
level: medium

KQL — Microsoft Sentinel / Defender for Endpoint

Hunt for SQL Server post-exploitation behavior across your fleet. The first clause catches the engine spawning shells (high fidelity); the second catches interactive clients invoking dangerous features (medium fidelity, worth triaging).

let dangerous_children = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","curl.exe"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "sqlservr.exe"
    | where FileName in~ (dangerous_children)
    | extend AlertType = "SQL Server spawned command shell or LOLBin"
),
(
    DeviceProcessEvents
    | where FileName in~ ("sqlcmd.exe","osql.exe")
    | where ProcessCommandLine has_any ("xp_cmdshell","sp_configure","Ole Automation","Ad Hoc Distributed Queries","OPENROWSET","xp_dirtree")
    | extend AlertType = "SQL client invoked dangerous stored procedure"
)
| project TimeGenerated, AlertType, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

If you ingest SQL Server audit logs or Sysmon into Sentinel, also alert on failed-authentication anomalies and new logins created or added to sysadmin — privilege-elevation exploits are frequently followed by persistence via new SQL logins:

SecurityEvent
| where EventID in (4728, 4732, 4756)
| where TargetUserName has_any ("MSSQL","SQLSVC")
    or Computer in (device_dynamic_scope_of_your_sql_servers)
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, TargetDomainName
| order by TimeGenerated desc

Velociraptor VQL — Fleet-Wide Hunt

Identify every host where sqlservr.exe has spawned a child process, and simultaneously surface which hosts are listening on 1433 from unexpected interfaces. This is a fast scoping artifact for IR triage:

-- Hunt for child processes spawned by sqlservr.exe (post-exploitation indicator for CVE-2026-65669 class attacks)
LET sql_pids = SELECT Pid, Name FROM pslist() WHERE Name =~ '(?i)sqlservr'

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM sql_pids)

-- Surface unexpected listeners on TCP 1433 across the fleet for exposure scoping
SELECT Pid, Name, Laddr, Lport, Status
FROM netstat()
WHERE Lport = 1433 AND Status = 'LISTEN'

Verification & Hardening Script

Run this on database servers (or via your RMM/Intune against the SQL fleet) to inventory instances and builds, review firewall exposure, and lock down the dangerous features that turn a database compromise into a host compromise. Patch builds for CVE-2026-65669 must be confirmed against Microsoft's advisory — the script flags your current builds so you can compare.

# CVE-2026-65669 - SQL Server inventory, exposure check, and hardening verification
# Run elevated. Review output before applying any changes.

# 1) Enumerate installed SQL Server instances and builds
Write-Host "=== Installed SQL Server Instances ===" -ForegroundColor Cyan
$instanceRoot = 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL'
if (Test-Path $instanceRoot) {
    Get-ItemProperty $instanceRoot | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            $setupKey = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$($_.Value)\Setup"
            $setup = Get-ItemProperty $setupKey -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                Instance = $_.Name
                Version  = $setup.Version
                Edition  = $setup.Edition
            }
        }
    } | Format-Table -AutoSize
    Write-Host "Compare the Version values above against the patched build numbers in the Microsoft advisory for CVE-2026-65669:`nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669" -ForegroundColor Yellow
} else {
    Write-Host "No SQL Server instances registered on this host." -ForegroundColor Green
}

# 2) Check current firewall posture for SQL Server ports
Write-Host "`n=== Firewall rules referencing SQL/1433 ===" -ForegroundColor Cyan
Get-NetFirewallRule -ErrorAction SilentlyContinue |
    Where-Object { $_.Enabled -eq 'True' -and ($_.DisplayName -match 'SQL|1433|1434') } |
    Select-Object DisplayName, Direction, Action, Profile | Format-Table -AutoSize

# 3) Disable dangerous server features (requires sysadmin credentials; uses sqlcmd)
# These features convert database privilege escalation into OS command execution.
# Uncomment and target your instances explicitly after the patch is applied.
<#
$instances = @('localhost\MSSQLSERVER')
foreach ($i in $instances) {
    sqlcmd -S $i -Q "EXEC sp_configure 'xp_cmdshell', 0; EXEC sp_configure 'Ole Automation Procedures', 0; EXEC sp_configure 'Ad Hoc Distributed Queries', 0; RECONFIGURE;"
}
#>

# 4) Restrict TCP 1433 to application-tier subnets only (example - adjust CIDR to your app tier)
# New-NetFirewallRule -DisplayName 'SQL 1433 - App Tier Only' -Direction Inbound -Protocol TCP -LocalPort 1433 -RemoteAddress 10.20.30.0/24 -Action Allow
# New-NetFirewallRule -DisplayName 'SQL 1433 - Block All Other' -Direction Inbound -Protocol TCP -LocalPort 1433 -Action Block

# 5) Confirm SQL Server service accounts are not local admins
Write-Host "`n=== SQL Server services and logon accounts ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service -Filter "Name LIKE 'MSSQL%'" |
    Select-Object Name, StartName, State | Format-Table -AutoSize
Write-Host "Any account above that is a member of local Administrators or runs as SYSTEM should be replaced with a gMSA or least-privilege account." -ForegroundColor Yellow

Remediation

1. Patch immediately. Apply the Microsoft security update addressing CVE-2026-65669 for every supported SQL Server branch in your environment. Confirm the exact GDR/CU build numbers and download links in the Microsoft Security Update Guide entry for CVE-2026-65669 and the NVD record. Verify post-patch with SELECT SERVERPROPERTY('ProductVersion');. Given the 9.6 network/unauthenticated profile, this belongs in your emergency change window, not the next monthly cycle. Monitor CISA KEV for a federal remediation deadline — if it lands there, private-sector orgs should treat that date as their own ceiling.

2. Eliminate network exposure. No SQL Server instance should ever answer on the public internet. Audit external attack surface (your own scans plus Shodan/Censys checks on your ASN ranges) for TCP 1433. Internally, restrict 1433 to application-tier subnets via host firewall and network segmentation; disable the SQL Browser service (UDP 1434) where not required.

3. Harden the engine. Disable xp_cmdshell, Ole Automation Procedures, and Ad Hoc Distributed Queries (script above). These don't fix the CVE — they break the post-exploitation bridge from database privilege to host command execution, which is where the real damage happens.

4. Enforce least privilege on service accounts. SQL Server services should run under gMSA or dedicated least-privilege accounts — never SYSTEM, never Domain Admin, never local Administrator. If CVE-2026-65669 yields service-account context, a tightly scoped account contains the blast radius.

5. Fix the application layer. Injection-class flaws thrive on unsanitized input paths. Enforce parameterized queries/ORM discipline in every application that talks to SQL Server, and position a WAF in front of web tiers that front database functionality.

6. Deploy and monitor. Push the Sigma rules above through your SIEM pipeline, enable the KQL hunts on a scheduled cadence, and turn on SQL Server Audit (or Extended Events) capturing login creation, role membership changes, and sp_configure modifications. Alert on any sysadmin role grant.

7. Hunt retroactively. If patching lags, assume probing has already occurred. Run the Velociraptor artifact fleet-wide and review SQL Server error logs for malformed/authentication anomalies preceding your patch date.

If you need help scoping exposure across a large SQL Server estate, validating your segmentation, or pressure-testing these detections with a controlled purple-team exercise, reach out — this is exactly the work we do.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub