CVE-2000-0402: Microsoft SQL Server 7.0 stores sa password in plaintext log file

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw exposes full administrative database credentials, but it requires local file read access and affects a long-obsolete product version.

What it is

Microsoft SQL Server 7.0's Mixed Mode authentication writes the System Administrator (sa) account password in plaintext to a log file that any user can read. Because the sa account holds full control of the database server, exposure of its credentials undermines the entire authentication model of the product.

Impact

An attacker who reads the log file obtains the sa password and can authenticate as the database administrator, gaining full control over the SQL Server instance and its data.

Attack surface

Reached locally by reading a log file on the host, per the AV:L vector; no authentication is required (Au:N) and no user interaction is indicated. The description states the file is readable by any user, so any local account on the system can reach it.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, so there is no confirmed in-the-wild exploitation in this record; EPSS is high (0.906, 99.8th percentile), but that score alone does not establish active exploitation.

What to do

• Apply the fix referenced in Microsoft security bulletin MS00-035 (and KB 263968) for SQL Server 7.0.
• Restrict file system permissions on SQL Server log directories so only administrators can read them.
• Avoid Mixed Mode authentication where possible, or rotate the sa password after any suspected log exposure.
• Audit and purge existing log files that may contain plaintext credentials.

Detection

• Search SQL Server log directories for files containing the sa account name or plaintext password strings.
• Monitor file access to SQL Server log paths by non-administrative accounts.
• Alert on successful sa logins from hosts or processes that do not normally use that account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.