EUVD-2026-44033
GHSA-84xv-35h8-r47j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L confirmed by 'authorized attacker' language; AV:N retained as SQL Server is network-accessible, with local escalation being the impact, not the vector.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploitable by any low-privilege authenticated SQL Server user. CWE-73 (External Control of File Name or Path) allows an authorized attacker to supply or manipulate file path parameters - likely through SQL operations such as BULK INSERT, BACKUP/RESTORE, or FILESTREAM commands - to escape intended access boundaries and elevate local operating system or SQL Server privileges. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the SSVC framework rates Technical Impact as total, indicating full system compromise is achievable upon successful exploitation. The EPSS score of 0.24% (15th percentile) reflects low current exploitation probability.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a class of vulnerability where an application constructs file paths using externally-controlled input without sufficient validation, enabling attackers to traverse directory boundaries or redirect file operations to unintended locations. In the Microsoft SQL Server context, this is likely triggered through privileged file I/O operations accessible to low-privilege SQL principals - candidates include T-SQL constructs like BULK INSERT, OPENROWSET with file source, BACKUP TO, RESTORE FROM, or xp_cmdshell-adjacent functionality. The attacker-controlled path may redirect read or write operations to sensitive OS-level files, enabling privilege escalation from a SQL Server login to a higher OS or sysadmin role. Affected products span five major release branches per CPE: SQL Server 2016 SP3 (GDR and Azure Connect Feature Pack), 2017 (CU 31 and GDR), 2019 (CU 32 and GDR), 2022 (GDR and CU 25), and 2025 (CU 6 and GDR). There is a notable tension between the CVSS vector (AV:N, implying network-reachable attack surface) and the description's use of 'locally' to describe privilege escalation - this likely means the escalation effect is on the local host system, not that the attacker must be physically present, since SQL Server is inherently a network-accessible service.
RemediationAI
The primary fix is to apply Microsoft's released cumulative updates or GDR patches for each affected branch, as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55002. Specific fixed versions are: SQL Server 2016 SP3 GDR update to 13.0.6500.1 or later; SQL Server 2016 SP3 Azure Connect Feature Pack to 13.0.7095.1 or later; SQL Server 2017 CU 31 to 14.0.3540.1 or later; SQL Server 2017 GDR to 14.0.2120.1 or later; SQL Server 2019 CU 32 to 15.0.4480.2 or later; SQL Server 2019 GDR to 15.0.2180.2 or later; SQL Server 2022 CU 25 to 16.0.4262.2 or later; SQL Server 2022 GDR to 16.0.1190.2 or later; SQL Server 2025 CU 6 to 17.0.4060.2 or later; and SQL Server 2025 GDR to 17.0.1125.2 or later. Until patching is complete, reduce risk by auditing and restricting SQL logins that have access to file I/O operations - specifically, revoke or restrict BULKADMIN role membership and ADMINISTER BULK OPERATIONS permission for accounts that do not require it, as these are common enablers of file path manipulation in SQL Server. Additionally, restrict SQL Server service account privileges to the minimum required OS permissions (avoid LocalSystem or high-privilege accounts), which limits the escalation ceiling even if the vulnerability is triggered. Ensure network access to SQL Server ports (1433/TCP by default) is restricted to authorized hosts via firewall rules to reduce the network attack surface.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) arises from unsafe deserialization of untrusted da
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today