EUVD-2026-73814
GHSA-9c22-76g9-f83j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable injection requiring only low-privilege SQL credentials; full CIA impact within the instance is consistent with privilege escalation to dbo or sysadmin.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
AnalysisAI
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server login with at minimum low (non-administrative) database privileges - PR:L in the CVSS vector confirms authentication is mandatory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H presents a high-priority remediation target for organizations running multi-tenant SQL Server instances, shared database infrastructure, or environments where external or minimally-trusted accounts hold SQL logins. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released patches for the specific SQL Server version and servicing branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SQL Server 2017, 2019, 2022, and 2025 instances in your infrastructure and prioritize systems containing sensitive data, noting that any database user can exploit this vulnerability regardless of their role. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today