Disclosed vulnerability
CVE-2026-65669: crafted instructions to SQL Copilot in SSMS 22 bypass its read-only restriction to read or modify database data
AIR-2026-0228 AIR record · 2026-09-microsoft-sql-copilot-readonly-bypass
From the supporting source
This bug even has an AI component, as the attacker would need to convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio.msrc.microsoft.com
The record
Disclosed
2026-09-08
Vendor
Microsoft
Product
SQL Copilot (SQL Server Management Studio 22)
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — crafted instructions make SQL Copilot read or modify data past its read-only restriction; a prompt-injection mechanism
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Crafted instructions prompt injection
Impact type
Unauthorized database access, Data modification, Scope violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
SQL Server Management Studio 22.0 up to 22.8.2 with SQL Copilot
Capability abused
Defense & remediation
Recorded defense
SQL Copilot read-only restriction
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
SQL Server Management Studio 22.8.2 (September 2026 Patch Tuesday)
Taxonomy & references
Curator notes
CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C). Microsoft-issued CVE titled 'SQL Server Elevation of Privilege'; the real mechanism is prompt injection against the SQL Copilot assistant. MSRC: not publicly disclosed, not exploited, exploitation 'Less Likely'. The flaw grants no new permissions - it lets the assistant act with the connected account's existing permissions despite a read-only expectation. Automox: 'That's a prompt-injection problem wearing a CVE number.' Fix is in SSMS, not the database engine.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-65669: crafted instructions to SQL Copilot in SSMS 22 bypass its read-only restriction to read or modify database data". AIR, AIR-2026-0228. https://agentincident.vercel.app/i/AIR-2026-0228/ (accessed 2026-10-19).