H3-2026-0077¶

Microsoft SQL Server Linked Servers

Description¶

A Microsoft SQL Server linked server was discovered that connects the source instance to a remote SQL Server. Linked servers can introduce risk through three configurations: permissive login mappings that grant broad access to the link, saved remote credentials (non-self-credential mappings) that allow sysadmin users to impersonate mapped logins and traverse the link without knowing the remote password, and RPC Out which permits remote stored procedure execution on the target. The severity depends on how the link is configured — a link with restricted access, self-credential mappings, and RPC Out disabled poses minimal risk.

Impact¶

An attacker who gains access to the source SQL Server can leverage linked server misconfigurations to reach the target instance. Overly permissive mappings (e.g., a default mapping allowing all authenticated users) expand the attack surface to every user on the source. Saved remote credentials allow any sysadmin on the source to impersonate the mapped login via EXECUTE AS LOGIN and authenticate to the remote instance as the saved account — even without knowing the remote password. If RPC Out is enabled, the attacker can execute operating system commands via xp_cmdshell or create SQL Agent jobs on the target, escalating from data access to remote code execution. When all three are present — permissive access, a stored privileged credential like sa, and RPC Out — any sysadmin-equivalent user on the source gains full control of the linked host.

References¶

• Microsoft: Linked Servers (Database Engine)
• Microsoft: sp_addlinkedserver (Transact-SQL)
• MITRE ATT&CK Technique: T1210: Exploitation of Remote Services
• MITRE ATT&CK Technique: T1078: Valid Accounts