CVE-2026-55002 is a Microsoft SQL Server elevation of privilege vulnerability classified as External Control of File Name or Path. It has a CVSS v3.1 base score of 7.8 and temporal score of 6.8, with a LOCAL attack vector, LOW attack complexity, LOW privileges required, and no user interaction. Microsoft says exploitation is not known and exploit code maturity is UNPROVEN. If exploited, an attacker could gain sysadmin privileges. Because the attack requires local access and low privileges, enterprise risk is highest where untrusted local users or code can run on SQL Server hosts.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH.
- Exploitation likelihood: Exploitation Less Likely; LOCAL vector, LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High severity, but local-only exposure reduces risk to internet-facing services; risk is more relevant on systems with local access by untrusted users or code.
- Patch status: available; customer action required.

Affected systems:
- SQL Server 2025 CU6+GDR
- SQL Server 2025 RTM+GDR
- SQL Server 2022 CU25+GDR
- SQL Server 2022 RTM+GDR
- SQL Server 2019 CU32+GDR
- SQL Server 2019 RTM+GDR
- SQL Server 2017 CU31+GDR
- SQL Server 2017 RTM+GDR
- SQL Server 2016 Azure Connect Feature Pack+GDR
- SQL Server 2016 SP3+GDR