Microsoft Sql Server 2016 Service Pack 3 Gdr
Monthly
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploitable by any low-privilege authenticated SQL Server user. CWE-73 (External Control of File Name or Path) allows an authorized attacker to supply or manipulate file path parameters - likely through SQL operations such as BULK INSERT, BACKUP/RESTORE, or FILESTREAM commands - to escape intended access boundaries and elevate local operating system or SQL Server privileges. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the SSVC framework rates Technical Impact as total, indicating full system compromise is achievable upon successful exploitation. The EPSS score of 0.24% (15th percentile) reflects low current exploitation probability.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker to run arbitrary code on the database server by sending crafted data that the engine deserializes unsafely (CWE-502). Any account able to submit queries or data over the network to a vulnerable instance can achieve full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating and the RCE-with-low-privilege profile make it a high-priority patch.
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privileges on the database server. The flaw, tracked as CWE-89, exists within the SQL Server engine's handling of user-supplied SQL input, allowing insufficient neutralization to be leveraged for privilege elevation. Publicly available exploit code exists (GitHub gist), though CISA has not yet added this to the KEV catalog and SSVC indicates no confirmed active exploitation; EPSS sits at 0.57% (44th percentile), suggesting low but non-trivial opportunistic exploitation risk.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploitable by any low-privilege authenticated SQL Server user. CWE-73 (External Control of File Name or Path) allows an authorized attacker to supply or manipulate file path parameters - likely through SQL operations such as BULK INSERT, BACKUP/RESTORE, or FILESTREAM commands - to escape intended access boundaries and elevate local operating system or SQL Server privileges. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the SSVC framework rates Technical Impact as total, indicating full system compromise is achievable upon successful exploitation. The EPSS score of 0.24% (15th percentile) reflects low current exploitation probability.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated, low-privileged attacker to run arbitrary code on the database server by sending crafted data that the engine deserializes unsafely (CWE-502). Any account able to submit queries or data over the network to a vulnerable instance can achieve full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 8.8 rating and the RCE-with-low-privilege profile make it a high-priority patch.
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privileges on the database server. The flaw, tracked as CWE-89, exists within the SQL Server engine's handling of user-supplied SQL input, allowing insufficient neutralization to be leveraged for privilege elevation. Publicly available exploit code exists (GitHub gist), though CISA has not yet added this to the KEV catalog and SSVC indicates no confirmed active exploitation; EPSS sits at 0.57% (44th percentile), suggesting low but non-trivial opportunistic exploitation risk.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally via improper neutralization of SQL command elements. Affected versions include SQL Server 2016 SP3, 2017, 2019, 2022, and 2025 across multiple cumulative updates and GDR releases. The CVSS 6.7 score reflects the requirement for high-privilege authentication and local attack vector, but the high confidentiality, integrity, and availability impact makes this a material risk f
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges locally through improper neutralization of special elements in SQL commands. Affected versions span SQL Server 2016 SP3 through 2025, with patch available from Microsoft. Attack requires local access and high-privilege credentials (PR:H in CVSS vector), limiting real-world impact to insider threats or compromised administrative accounts; CVSS 6.7 reflects high confidentiality, integrity, and availability impact but constrained by authentication and local-only attack vector.