Review reviewHigh

CVE-2026-20803

Microsoft Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 22), Microsoft SQL Server 2025 for x64-based Systems (GDR)

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.2

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

Product: Microsoft Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 22), Microsoft SQL Server 2025 for x64-based Systems (GDR)
Affected versions: >= 16.0.0 < 16.0.1165.1, >= 16.0.0.0 < 16.0.4230.2, >= 17.0.1050.2 < 17.0.1050.2, >= 16.0.1000.6 < 16.0.1165.1, >= 16.0.4003.1 < 16.0.4230.2, 17.0.1000.7
Fixed versions: 16.0.1165.1, 16.0.4230.2

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Microsoft Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 22), Microsoft SQL Server 2025 for x64-based Systems (GDR) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.