CVE-2026-20803

Microsoft · Published January 13, 2026

7.2

CVSS v3.1

HIGH

Patch availableGet patch

Description

Microsoft SQL Server Elevation of Privilege Vulnerability. Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected Products

Microsoft SQL Server 2022 for x64-based Systems (GDR)
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Microsoft SQL Server 2022 for x64-based Systems (CU 22)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C