What is the CVSS score of CVE-2026-47295?

CVE-2026-47295 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Microsoft SQL Server are affected by CVE-2026-47295?

Microsoft SQL Server environments (versions 2016 SP3 through 2025) face a critical privilege escalation risk where existing database users can elevate their access to perform unauthorized data…. A patch is available.

Is there a public PoC exploit available for CVE-2026-47295?

Yes, a public proof-of-concept exploit is available for CVE-2026-47295. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-47295?

Within 24 hours, inventory all Microsoft SQL Server instances running versions 2016 SP3, 2017, 2019, 2022, or 2025, and document which accounts have database-level access. Within 7 days, apply the vendor patch to all affected instances, starting with production environments and proceeding through staging and development. Within 30 days, verify all instances have been patched through version validation and review database access controls to enforce principle of least privilege.

Microsoft SQL Server CVE-2026-47295

EUVD-2026-44114 HIGH

SQL Injection (CWE-89)

2026-07-14 microsoft

GHSA-fxxm-g9hf-2q4h

SQLi Microsoft Microsoft Sql Server 2016 Service Pack 3 Gdr Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack Microsoft Sql Server 2017 Cu 31 Microsoft Sql Server 2017 Gdr Microsoft Sql Server 2019 Cu 32 Microsoft Sql Server 2019 Gdr Microsoft Sql Server 2022 Gdr Microsoft Sql Server 2025 For X64 Based Systems Gdr Microsoft Sql Server 2022 For X64 Based Systems Cu 25 Microsoft Sql Server 2025 Cu 6

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-reachable SQL injection needing only a low-privileged login (PR:L) and no user interaction; privilege elevation yields high C/I/A within the unchanged scope of the database server.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:55 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.

Technical ContextAI

The vulnerability is a SQL injection (CWE-89) in Microsoft SQL Server, Microsoft's relational database management system used across enterprise, cloud (Azure Connect Feature Pack), and application-backend deployments. The CPE data confirms the affected engine spans SQL Server 2016 Service Pack 3 (GDR and Azure Connect Feature Pack), 2017 (GDR and CU 31), 2019 (GDR and CU 32), 2022 (GDR and CU 25), and 2025 (GDR and CU 6). Improper neutralization means user-controllable input reaches a SQL command context without adequate sanitization or parameterization, letting an attacker break out of the intended query and execute attacker-chosen SQL - here leveraged not for pure data theft but to elevate the effective privileges of the connecting principal within the server.

RemediationAI

Apply the vendor-released security update for your specific SQL Server branch as tracked in the Microsoft MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47295); Patch available per vendor advisory covers SQL Server 2016 SP3 (GDR and Azure Connect Feature Pack), 2017 (GDR/CU 31), 2019 (GDR/CU 32), 2022 (GDR/CU 25), and 2025 (GDR/CU 6) - select the GDR or CU package matching your current servicing train and install the corresponding fixed build. Because exploitation requires an authenticated (PR:L) principal, compensating controls until patching include tightening database logins to least privilege and revoking unnecessary accounts, restricting network reachability of the SQL Server port (default TCP 1433) to trusted application hosts via firewall rules, and enabling query auditing/monitoring for anomalous statements; note these reduce but do not eliminate risk from a legitimate low-privileged account and may disrupt applications that rely on broad connectivity.