Executive brief
Microsoft SQL Server contains an SQL injection vulnerability that allows an authenticated attacker to execute arbitrary SQL commands and escalate privileges. This could enable an attacker with database access to gain administrative control, access sensitive data, or disrupt database operations.
Technical details
The vulnerability is a SQL injection flaw in SQL Server that arises from improper neutralization of special characters in SQL commands. An authorized attacker with network connectivity to the SQL Server can craft malicious SQL queries that bypass input validation and execute arbitrary code with elevated privileges. The attack requires existing authentication but allows privilege escalation from a standard user account to administrative or system-level access.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed