EUVD-2026-22558
GHSA-g255-j628-fcw3
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.
Technical ContextAI
SQL injection (CWE-89) occurs when user-supplied input is concatenated into SQL commands without proper parameterization or escaping, allowing attackers to inject arbitrary SQL syntax. In this SQL Server context, the vulnerability resides in server-side query processing where inadequately sanitized input from a high-privileged user is passed to the SQL engine. The affected CPE entries span multiple SQL Server editions and cumulative update (CU) and general distribution release (GDR) tracks across versions 13.0 (2016 SP3) through 17.0 (2025), indicating the flaw affects core query parsing logic present across nearly a decade of releases. An authenticated attacker with high-level permissions (such as a database admin or system administrator role) can craft malicious SQL to escape the intended query context and execute unauthorized operations with the privilege level of their own session, potentially escalating to system-level compromise.
RemediationAI
Apply Microsoft-released security patches immediately. For SQL Server 2016 SP3, update to GDR build 13.0.6485.1 or Azure Connect Feature Pack 13.0.7080.1 or later. For SQL Server 2017, apply CU 31 (14.0.3525.1) or GDR (14.0.2105.1) or later. For SQL Server 2019, update to CU 32 (15.0.4465.1) or GDR (15.0.2165.1) or later. For SQL Server 2022, apply GDR (16.0.1175.1) or CU 24 (16.0.4250.1) or later. For SQL Server 2025, update to CU 3 (17.0.4030.1) or x64 GDR (17.0.1110.1) or later. As interim mitigation, restrict SQL Server administrative roles strictly to necessary personnel and audit high-privilege account activity for suspicious query patterns. Refer to Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167) for detailed patching instructions.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker t
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploita
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today