Microsoft's Record 966-CVE Patch Tuesday Includes a SQL Copilot Prompt Injection That Writes to the Database (CVE-2026-65669, CVE-2026-80098, CVE-2026-81380)

SQL Copilot in SQL Server Management Studio 22, Copilot Studio, and GitHub Copilot in Visual Studio Code

The September 2026 Patch Tuesday on September 8 closed 966 vulnerabilities, the largest single month on record, with 105 rated critical and two zero-days under active exploitation (CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC), neither AI-related. Three of the fixes are. CVE-2026-65669 (CVSS 9.6) is a prompt injection in SQL Copilot inside SQL Server Management Studio 22: an attacker persuades a user to submit crafted instructions to the assistant, the instructions bypass the assistant's read-only restriction, and database data is read or modified using the connected user's permissions. Microsoft rated exploitation "less likely," which is a judgment about the social step rather than the technical one, since the bypass itself needs no vulnerability beyond the assistant reading its input as instruction. CVE-2026-80098 is a critical elevation of privilege in Copilot Studio rated CVSS 9.3, caused by improper verification of a cryptographic signature. CVE-2026-81380 and CVE-2026-81381 are information disclosure flaws in GitHub Copilot and Visual Studio Code in which improper neutralization of special command elements lets an unauthorized attacker cause Copilot agent mode to send sensitive material from the developer's environment to an attacker-controlled service. This is the second consecutive month in which an agent-mode Copilot flaw ships alongside a Copilot Studio privilege flaw, following CVE-2026-59118 and CVE-2026-70335 in August

A read-only restriction enforced by instructing the assistant rather than by the database grant underneath it, which makes the restriction only as durable as the model's willingness to keep following the earlier instruction. The Copilot agent-mode pair is the recurring version of the same problem: content the agent reads becomes a command it runs