The vulnerability is a missing authentication check for a critical function in Microsoft SQL Server. An attacker who already has some level of authorized access can exploit the flaw to elevate their privileges within the database engine. This elevated privilege can lead to unauthorized data access, modification, or further attacks on the broader network, compromising confidentiality, integrity, and availability.

Microsoft SQL Server 2022 (GDR) and the x64-based version with CU 22, as well as Microsoft SQL Server 2025 (GDR). The affected releases include the 17.0.1000.7 build for the x64 platform.

The CVSS score is 7.2, reflecting a high severity, while the EPSS score is less than 1%, indicating that, as of now, exploitation is unlikely to be widely observed. The vulnerability is not listed in the CISA KEV catalog, further suggesting low exploit visibility. The attack vector is likely remote network‑based, requiring the attacker to first authenticate to the SQL Server instance. Once authenticated, the attacker can invoke the vulnerable function and gain privileges beyond those originally granted.