CVE-2026-33120

CVE-2026-33120 is an untrusted pointer dereference vulnerability in SQL Server that permits authorized attackers to execute arbitrary code remotely over a network. This vulnerability affects SQL Server systems and requires valid user credentials to exploit, limiting the attack surface to authenticated users with network access. The vulnerability carries a CVSS severity rating of 8.8 (HIGH) with a network attack vector and low attack complexity, indicating that exploitation can be executed easily once authentication is obtained. The impact is severe across all three security dimensions: confidentiality, integrity, and availability are all rated as high, meaning successful exploitation could lead to complete system compromise. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed on the KEV catalog and is marked as inactive on threat intelligence tracking lists. The EPSS score of 0.0007 suggests minimal real-world exploitation probability to date, though organizations should still prioritize patching given the high CVSS severity rating and complete impact potential.