CVE-2026-65669

Name of the Vulnerable Software and Affected Versions SQL Server (affected versions not specified)

Description Improper neutralization of special elements in output used by a downstream component (injection) allows an unauthorized attacker to elevate privileges over a network. When using SQL Copilot in SQL Server Management Studio, crafted instructions can cause the system to act using the user's database permissions, as it treats these instructions as untrusted input.

Recommendations Apply the current month's update for SQL Server. Treat all instructions passed to SQL Copilot as untrusted input.