CVE-2026-55002: SQL Server Privilege Escalation Vulnerability

CVE-2026-55002 Overview

CVE-2026-55002 is a local privilege escalation vulnerability in Microsoft SQL Server. The flaw stems from external control of a file name or path [CWE-73], allowing an authorized attacker to manipulate file references processed by the database engine. Successful exploitation lets the attacker elevate privileges on the host system.

The issue affects the confidentiality, integrity, and availability of the target system. Because the attack vector is local and requires authentication, exploitation depends on an attacker first obtaining valid credentials on the SQL Server host. Microsoft has published guidance through the Microsoft Security Response Center.

Critical Impact
An authenticated local attacker can escalate privileges on hosts running vulnerable SQL Server instances, gaining full control over confidentiality, integrity, and availability.

Affected Products

Microsoft SQL Server (see the Microsoft advisory for specific build ranges)
Windows hosts running affected SQL Server instances
Environments where low-privileged SQL logins have access to file-path parameters

Discovery Timeline

2026-07-14 - CVE-2026-55002 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55002

Vulnerability Analysis

The vulnerability is classified under [CWE-73]: External Control of File Name or Path. SQL Server accepts a file name or path from an authenticated user and uses it in a privileged operation without sufficient validation. An attacker can supply a crafted path that redirects file operations to a location of their choosing.

By pointing the operation at a file the attacker controls or a target owned by a higher-privileged principal, the attacker can overwrite, replace, or load resources under the SQL Server service context. This context typically runs with elevated rights on the Windows host, resulting in local privilege escalation.

Root Cause

The root cause is insufficient validation of user-supplied file path inputs. SQL Server trusts a path that a low-privileged authenticated user can influence, then performs a file operation with the privileges of the database engine service account. The absence of canonicalization, allow-listing, or privilege separation on the file-path parameter enables the escalation.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. The attacker must authenticate to the SQL Server instance with a valid login. From that position, the attacker invokes a feature that accepts a file name or path parameter and substitutes a path that the SQL Server service will access or write to on their behalf.

No verified public exploit code is available at publication. Refer to the Microsoft Security Update for CVE-2026-55002 for authoritative technical details.

Detection Methods for CVE-2026-55002

Indicators of Compromise

SQL Server error log entries referencing unexpected file paths, UNC shares, or symbolic links supplied through T-SQL statements.
Windows security events showing file writes or reads by the SQL Server service account (MSSQLSERVER) to directories outside typical database paths.
New or modified files in system directories with timestamps correlating to SQL Server activity from low-privileged logins.

Detection Strategies

Audit T-SQL statements that reference file paths, including BACKUP, RESTORE, BULK INSERT, OPENROWSET, and extended stored procedures.
Correlate SQL logins with process and file activity from sqlservr.exe to identify anomalous file operations initiated by non-administrative accounts.
Enable SQL Server audit specifications for schema and server-level events that expose file-path parameters.

Monitoring Recommendations

Forward SQL Server error logs, audit logs, and Windows Security event logs to a central analytics platform for correlation.
Alert on file writes by the SQL Server service account outside approved data, log, and backup directories.
Track privilege changes and new local administrators created on hosts running SQL Server following suspicious database activity.

How to Mitigate CVE-2026-55002

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update for CVE-2026-55002 advisory to all affected SQL Server instances.
Inventory SQL Server logins and revoke unused or over-privileged accounts, particularly those with access to file-path features.
Restrict the SQL Server service account to the minimum Windows privileges required for operation.

Patch Information

Microsoft has released a security update addressing CVE-2026-55002. Consult the Microsoft Security Update for CVE-2026-55002 guide for the specific cumulative update or GDR build that applies to each supported SQL Server version. Test the update in a non-production environment before rolling it out to production database servers.

Workarounds

Limit membership in server roles that can execute file-path operations such as BACKUP, RESTORE, and BULK INSERT.
Disable or restrict xp_cmdshell, OLE Automation Procedures, and ad-hoc distributed queries where they are not required.
Apply file system access control lists so the SQL Server service account cannot write to sensitive system directories.
Segment database servers on isolated network zones to reduce the value of any compromised local session.

bash

# Configuration example: reduce exposed surface on SQL Server
# Run in SQL Server Management Studio against each affected instance

EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;

EXEC sp_configure 'xp_cmdshell', 0;
EXEC sp_configure 'Ole Automation Procedures', 0;
EXEC sp_configure 'Ad Hoc Distributed Queries', 0;
RECONFIGURE;