CVE-2026-47296

Microsoft SQL Server Elevation of Privilege Vulnerability

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Analysis

AI-generated

Technical impact

This vulnerability involves an improper neutralization of special elements in SQL commands, resulting in a SQL injection flaw that allows an authorized attacker to elevate privileges over a network. The weakness is categorized as CWE-89. The impact is the ability to gain higher privileges, potentially enabling an attacker to access restricted data or compromise the database server.

Affected Systems

Affected are Microsoft SQL Server releases from version 2016 through 2025, including 2016 Service Pack 3 (GDR) and Azure Connect Feature Pack, 2017 CU 31 and GDR, 2019 CU 32 and GDR, 2022 GDR and CU 25, and 2025 CU 6 and GDR, all on x64-based systems.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, while an EPSS score of less than 1% signals a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based, requiring an authorized attacker who can connect to the SQL Server instance over the network to exploit the SQL injection flaw and elevate privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Microsoft security update that addresses CVE-2026-47296 to all affected SQL Server installations.
  • Restrict local accounts with elevated privileges and enforce least privilege for users who have access to the SQL Server instance.
  • Enable monitoring and logging to detect any attempted privilege escalation or anomalous SQL activity.

Generated by OpenCVE AI on August 5, 2026 at 02:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Microsoft microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack
Microsoft microsoft Sql Server 2017 (gdr)
Microsoft microsoft Sql Server 2019 (gdr)
Microsoft microsoft Sql Server 2022 For X64-based Systems (cu 23)
Microsoft microsoft Sql Server 2025 For X64-based Systems (gdr)
Vendors & Products Microsoft microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack
Microsoft microsoft Sql Server 2017 (gdr)
Microsoft microsoft Sql Server 2019 (gdr)
Microsoft microsoft Sql Server 2022 For X64-based Systems (cu 23)
Microsoft microsoft Sql Server 2025 For X64-based Systems (gdr)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Title Microsoft SQL Server Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft sql Server 2016
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
Weaknesses CWE-89
CPEs cpe:2.3:a:microsoft:sql_server_2016:*:sp3:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2017:*:-:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft
Microsoft sql Server 2016
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
microsoft
Published
Updated
Nov 10, 2026, 10:34 PM
Reserved
May 18, 2026, 11:53 PM

View source JSON

Updated
Jul 14, 2026, 5:44 PM

JSON

Status
Modified
Published
Jul 14, 2026, 5:16 PM
Modified
Aug 4, 2026, 12:16 AM

View source JSON

No data.

Updated
Aug 5, 2026, 2:45 AM

JSON