PT-2026-2656 · Microsoft · Sql Server

Published 2026-01-13 · Updated 2026-01-17 · CVE-2026-20803

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server (affected versions not specified)

Description A missing authentication check for a critical function in Microsoft SQL Server can allow an authorized attacker to elevate privileges over a network. The issue, caused by missing authentication, enables a high-privileged SQL Server user to gain debugging privileges and potentially dump system memory, which could expose sensitive information like secrets and credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-00478

CVE-2026-20803

Affected Products

Sql Server

References · 13

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20803 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20803 · Security Note
• https://bdu.fstec.ru/vul/2026-00478 · Security Note
• https://osv.dev/vulnerability/CVE-2026-20803 · Vendor Advisory
• https://bdu.fstec.ru/vul/CVE-2026-20803 · Security Note
• https://twitter.com/threatcluster/status/2011672277713113529 · Twitter Post
• https://twitter.com/dailytechonx/status/2011831373888098614 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20803 · Note
• https://twitter.com/ThreatSynop/status/2011651489576472604 · Twitter Post
• https://twitter.com/CinchOpsIT/status/2011800546039250959 · Twitter Post
• https://twitter.com/CVEnew/status/2012669660848882039 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011480483826110630 · Twitter Post