What is the CVSS score of EUVD-2026-29652?

EUVD-2026-29652 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft SQL Server are affected by EUVD-2026-29652?

Microsoft SQL Server versions 2016 SP3 through 2025 contain a high-severity remote code execution vulnerability (CVE-2026-40370) that allows authenticated database users to execute arbitrary code on…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-29652?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29652. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-29652?

Within 24 hours, identify and inventory all SQL Server instances running versions 2016 SP3 through 2025 and restrict database access to trusted users only. Within 7 days, apply the vendor-released patches from Microsoft across all affected SQL Server deployments, prioritizing production systems. Within 30 days, complete comprehensive patching of all remaining affected instances and verify successful patch deployment per Microsoft advisory guidance.

Microsoft SQL Server EUVD-2026-29652

| CVE-2026-40370 HIGH

External Control of File Name or Path (CWE-73)

2026-05-12 microsoft

GHSA-c4mg-2cmw-c72r

Information Disclosure Microsoft Microsoft Sql Server 2016 Service Pack 3 Gdr Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack Microsoft Sql Server 2017 Cu 31 Microsoft Sql Server 2017 Gdr Microsoft Sql Server 2019 Cu 32 Microsoft Sql Server 2019 Gdr Microsoft Sql Server 2022 Gdr Microsoft Sql Server 2022 For X64 Based Systems Cu 24 Microsoft Sql Server 2025 For X64 Based Systems Gdr Microsoft Sql Server 2025 Cu 4

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-reachable code execution requiring an existing low-privilege SQL login (PR:L), no user interaction, low complexity, yielding full CIA impact within the unchanged service scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:19 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 8.8

DescriptionCVE.org

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.

Technical ContextAI

The vulnerability is a CWE-73 (External Control of File Name or Path) weakness in Microsoft SQL Server, a widely deployed relational database engine. Affected components span the SQL Server 2016 Service Pack 3 (GDR and Azure Connect Feature Pack), 2017 (GDR/CU 31), 2019 (GDR/CU 32), 2022 (GDR/CU 24), and 2025 (GDR/CU 4) product lines per the provided CPE strings (cpe:2.3:a:microsoft:microsoft_sql_server_*). CWE-73 arises when an application uses attacker-influenced input to construct a file path without adequate validation or canonicalization; in a database engine this typically manifests through features that read or write server-side files (e.g., backup/restore paths, bulk import/export, or extensibility hooks). Because SQL Server's file operations execute in the context of the database service account, controlling the path enables reaching or overwriting files that lead to code execution over the network.

RemediationAI

Apply the Microsoft security update for your servicing branch to reach the fixed build: SQL Server 2016 SP3 GDR 13.0.6490.1 (Azure Connect Feature Pack 13.0.7085.1), 2017 GDR 14.0.2110.2 or CU 31 14.0.3530.2, 2019 GDR 15.0.2170.1 or CU 32 15.0.4470.1, 2022 GDR 16.0.1180.1 or CU 24 16.0.4252.3, and 2025 GDR 17.0.1115.1 or CU 4 (see advisory). Obtain exact packages from the Microsoft MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370. Because exploitation requires an authenticated low-privilege login (PR:L), until patching is complete reduce exposure by auditing and removing unnecessary database logins, enforcing least-privilege so application accounts cannot invoke file-path-dependent features, and network-restricting the SQL listener (TCP 1433 or your configured port) to trusted application hosts via firewall/segmentation - trade-off: tighter network ACLs may break legitimate remote clients and require an allowlist. Enable SQL auditing/monitoring on file-related operations to detect abuse in the interim. Do not disable core file features (backup/restore, bulk operations) blindly, as this can break maintenance jobs.