What is the CVSS score of EUVD-2026-29652?

EUVD-2026-29652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-29652?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29652. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-29652?

Yes, a patch is available for EUVD-2026-29652. Update the affected software to the latest version immediately.

Microsoft Sql Server 2016 Service Pack 3 Gdr EUVD-2026-29652

| CVE-2026-40370 HIGH

External Control of File Name or Path (CWE-73)

2026-05-12 microsoft

GHSA-c4mg-2cmw-c72r

Information Disclosure Microsoft Sql Server 2016 Service Pack 3 Gdr Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack Microsoft Sql Server 2017 Cu 31 Microsoft Sql Server 2017 Gdr Microsoft Sql Server 2019 Cu 32 Microsoft Sql Server 2019 Gdr Microsoft Sql Server 2022 Gdr Microsoft Sql Server 2022 For X64 Based Systems Cu 24 Microsoft Sql Server 2025 Cu 4 Microsoft Sql Server 2025 For X64 Based Systems Gdr

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 8.8

DescriptionCVE.org

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

Analysis

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

More in Microsoft Sql Server 2016 Service Pack 3 Gdr

View all

CVE-2026-54118 HIGH This Week

8.8 Jul 14

Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker t

CVE-2026-47295 HIGH This Week

8.8 Jul 14

Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S

CVE-2026-47296 HIGH This Week

7.8 Jul 14

Local privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an already-authenticated database user

CVE-2026-55002 HIGH This Week

7.8 Jul 14

Local privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an already-authenticated database user

CVE-2026-32176 MEDIUM This Month

6.7 Apr 14

SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca

CVE-2026-32167 MEDIUM This Month

6.7 Apr 14

SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca

Same weakness CWE-73 – External Control of File Name or Path

View all

CVE-2025-33053 HIGH POC

8.8

CVE-2023-4634 CRITICAL POC

9.8

CVE-2025-24054 MEDIUM POC

6.5

CVE-2025-0111 HIGH

7.1

CVE-2024-8517 CRITICAL POC

9.8

CVE-2024-55372 CRITICAL POC

9.8

CVE-2024-55371 CRITICAL POC

9.8

CVE-2025-29709 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

EUVD-2026-29652 vulnerability details – vuln.today

Back

Microsoft Sql Server 2016 Service Pack 3 Gdr EUVD-2026-29652

Severity by source

CVSS VectorVendor: microsoft

Lifecycle Timeline

DescriptionCVE.org

Analysis

More in Microsoft Sql Server 2016 Service Pack 3 Gdr

Same weakness CWE-73 – External Control of File Name or Path

Same technique Information Disclosure

Share

External POC / Exploit Code