What is the CVSS score of CVE-2026-47296?

CVE-2026-47296 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Sql Server 2016 Service Pack 3 Gdr are affected by CVE-2026-47296?

Microsoft SQL Server versions 2016 SP3 through 2025 contain a privilege escalation vulnerability allowing authenticated database users to gain unauthorized elevated access within the database.. A patch is available.

How to fix or mitigate CVE-2026-47296?

Within 24 hours, inventory all Microsoft SQL Server instances running versions 2016 SP3 through 2025 and identify which systems host critical data or applications, focusing remediation planning on production environments. Within 7 days, apply the vendor-released patch to all affected SQL Server instances, starting with critical systems and proceeding through non-production infrastructure. Within 30 days, complete patch deployment across all affected SQL Server deployments and validate successful patching through your change management and monitoring processes.

Microsoft Sql Server 2016 Service Pack 3 Gdr CVE-2026-47296

EUVD-2026-43967 HIGH

SQL Injection (CWE-89)

2026-07-14 microsoft

GHSA-448r-r56x-9vhx

SQLi Microsoft Sql Server 2016 Service Pack 3 Gdr Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack Microsoft Sql Server 2017 Cu 31 Microsoft Sql Server 2017 Gdr Microsoft Sql Server 2019 Cu 32 Microsoft Sql Server 2019 Gdr Microsoft Sql Server 2022 Gdr Microsoft Sql Server 2022 For X64 Based Systems Cu 25 Microsoft Sql Server 2025 Cu 6 Microsoft Sql Server 2025 For X64 Based Systems Gdr

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:35 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an already-authenticated database user to escalate their privileges by injecting crafted special elements into an SQL command. Microsoft has released a fix and reported the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all Microsoft SQL Server instances running versions 2016 SP3 through 2025 and identify which systems host critical data or applications, focusing remediation planning on production environments. …

Threat intelligence, references, and detailed analysis are available after sign-in.