EUVD-2026-22561
GHSA-vfhv-wjq9-p5qh
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
Technical ContextAI
This vulnerability exploits CWE-89 (SQL Injection) in Microsoft SQL Server's query processing engine. The root cause is improper neutralization of special characters or SQL metacharacters within dynamically constructed SQL commands, likely in stored procedures, system functions, or internal query layers that accept privileged user input. Unlike typical SQL injection vulnerabilities that affect application-layer queries, this flaw resides in the SQL Server engine itself, meaning any high-privilege account (e.g., sa, sysadmin role members) can craft malicious SQL to break out of intended query context and execute arbitrary SQL with their elevated privileges. The affected CPE entries span SQL Server 2016 SP3 through 2025 across both GDR (general distribution release) and CU (cumulative update) tracks, indicating the vulnerability was introduced in or before 2016 SP3 and persisted across multiple major versions and patch levels until recently fixed.
RemediationAI
Apply vendor-released patches immediately. For SQL Server 2016 SP3 (GDR), upgrade to version 13.0.6485.1 or later; for SQL Server 2016 SP3 Azure Connect Feature Pack, upgrade to 13.0.7080.1 or later. For SQL Server 2017 (GDR), upgrade to 14.0.2105.1 or later; for CU 31, upgrade to 14.0.3525.1 or later. For SQL Server 2019 (GDR), upgrade to 15.0.2165.1 or later; for CU 32, upgrade to 15.0.4465.1 or later. For SQL Server 2022 (GDR), upgrade to 16.0.1175.1 or later; for x64 CU 24, upgrade to 16.0.4250.1 or later. For SQL Server 2025 (GDR), upgrade to 17.0.1110.1 or later; for CU 3, upgrade to 17.0.4030.1 or later. No workarounds are available; patching is the only remediation. After patching, review and audit sysadmin role assignments and service account privileges to enforce principle of least privilege and reduce attack surface. See https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176 for patch downloads and deployment guidance.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker t
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploita
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today