Executive brief
A vulnerability in Microsoft SQL Server, a widely used database management system, could allow a user with low-level access to gain higher administrative permissions. By exploiting a flaw in how the database handles specific commands, an attacker could potentially access sensitive data or disrupt operations. This issue requires the attacker to already have local access to the system or database environment.
Technical details
Microsoft SQL Server is vulnerable to a local privilege escalation via SQL injection (CWE-89). The flaw stems from improper neutralization of special elements used in SQL commands within the server engine. An attacker with low-privileged local access can exploit this vulnerability to execute arbitrary SQL commands with higher privileges, potentially gaining full administrative control over the database instance. The vulnerability affects multiple versions including SQL Server 2016, 2017, 2019, 2022, and 2025. Microsoft has released security updates to address this issue across the affected versions.
Affected products
- Microsoft SQL Server 2016 Service Pack 3 (GDR) < 13.0.6500.1
- Microsoft SQL Server 2017 (CU 31) < 14.0.3540.1
- Microsoft SQL Server 2019 (CU 32) < 15.0.4480.2
- Microsoft SQL Server 2022 (GDR) < 16.0.1190.2
- Microsoft SQL Server 2025 (CU 6) < 17.0.4060.2
Timeline
- 2026-07-14: advisory: Initial advisory published by Microsoft and NVD.