Microsoft Sql Server 2025 Cu 4
Monthly
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.