CVE-2026-20803

HIGH 7.2CVE-2026-20803 · Published 13/01/2026 · updated 30/07/2026

In short

CVE-2026-20803 is a HIGH (CVSS 7.2) vulnerability affecting sql server 2022 (microsoft), sql server 2025 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.4% of all vulnerabilities.
Fix: update to 16.0.1165.1, 16.0.4230.2 or later.

Package	Affected versions	Patched versions
sql server 2022 microsoft	`≥ 16.0.1000.6, < 16.0.1165.1≥ 16.0.4003.1, < 16.0.4230.2`	`16.0.1165.116.0.4230.2`
sql server 2025 microsoft	`= 17.0.1000.7`	No fix yet

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.