Executive brief
Microsoft SQL Server contains a SQL injection vulnerability that allows an authorized attacker to execute arbitrary SQL commands and escalate their privileges. This could enable a malicious database user to gain administrative control over the database or access sensitive data they are not entitled to.
Technical details
The vulnerability is a SQL injection flaw in SQL Server that fails to properly neutralize special characters in SQL commands. An authenticated attacker who already has database access can inject malicious SQL code to bypass authorization checks and elevate their privileges. The attack is network-reachable and requires valid database credentials; no additional user interaction is needed. Successful exploitation allows privilege escalation from a lower-privilege account to administrative or system-level access within the database. Microsoft has released a security patch to address this vulnerability.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed