SQL Server's Copilot could be tricked into writing to databases

What happened

Microsoft published CVE-2026-65669 on 8 September 2026, a SQL Server elevation-of-privilege flaw rated Critical and scored CVSS 3.1 9.6, fixed in SQL Server Management Studio 22.8.2. Johann Rehberger's write-up of 30 September shows the bug in the Copilot built into Management Studio: its read-only mode rested on a system-prompt instruction and a regex blocklist, and a query that called sp_executesql through a variable ran writes with the connected user's rights, which can be sysadmin.

Copilot also loads instructions stored in the database as AGENTS.md and CONSTITUTION.md extended properties, which a lower-privileged user can write. Rehberger's demonstration had a database owner plant instructions that, once a sysadmin used Copilot, added the attacker's login to the sysadmin role, and he showed a table sent to an outside server one row at a time, over an SMB path through xp_dirtree. He presented the research at BlueHat Asia 2026, and Microsoft's advisory rated exploitation "less likely" at release.