Executive brief
Microsoft SQL Server, a widely used database management system, contains a vulnerability that allows an authorized user to execute malicious code on the server. By manipulating file paths or names, an attacker with basic access can gain full control over the database environment. This could lead to the theft of sensitive customer data, permanent loss of information, or a complete shutdown of database operations.
Technical details
A vulnerability exists in Microsoft SQL Server (versions 2016 through 2025) due to improper validation of user-supplied file names or paths (CWE-73/CWE-610). An authenticated attacker with low privileges can exploit this by providing a malicious path to a resource, leading to remote code execution on the underlying server. The attack is conducted over the network and does not require user interaction. Microsoft has released security updates to address this issue across the affected versions.
Affected products
- Microsoft SQL Server 2016 13.0.6300.2 to 13.0.6490.1, 13.0.7000.253 to 13.0.7085.1
- Microsoft SQL Server 2017 14.0.1000.169 to 14.0.2110.2, 14.0.3006.16 to 14.0.3530.2
- Microsoft SQL Server 2019 15.0.2000.5 to 15.0.2170.1, 15.0.4003.23 to 15.0.4470.1
- Microsoft SQL Server 2022 16.0.1000.6 to 16.0.1180.1, 16.0.4003.1 to 16.0.4252.3
- Microsoft SQL Server 2025 17.0.1000.7 to 17.0.1115.1, 17.0.4006.2 to 17.0.4040.1
Timeline
- 2026-05-12: disclosed: Initial publication of the vulnerability advisory.
- 2026-05-12: advisory: Microsoft released a vendor advisory and security updates.