Improper access control in Microsoft SQL Server allows an authorized attacker to elevate privileges over a network. The vulnerability is a CWE-284 (Improper Privilege Management) flaw, enabling the attacker to gain higher-level permissions and potentially execute operations reserved for administrators, compromising the confidentiality, integrity, and availability of the affected system.

The affected products are Microsoft SQL Server 2016 Service Pack 3, SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, SQL Server 2017 (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (GDR and CU 23 for x64), and SQL Server 2025 (CU 2 and GDR for x64). The CVE data does not provide more granular version delineation beyond these packages, so all mentioned builds are considered vulnerable.

The CVSS v3.1 score is 8.8, indicating high severity. The EPSS score is <1%, suggesting limited public exploitation evidence, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based, requiring an authorized but partially privileged user to invoke the flaw; exploitation does not require local system access.