Technical impact
The vulnerability is an improper neutralization of special elements used in an SQL command, classified as a classic SQL injection flaw (CWE-89). The flaw allows an attacker who already has authorized network access to the SQL Server to elevate to higher privileges.
Affected Systems
Affected products include Microsoft SQL Server 2017 (Cumulative Update 31 and the Generic Distribution Release), Microsoft SQL Server 2019 (Cumulative Update 32 and the Generic Distribution Release), Microsoft SQL Server 2022 (Cumulative Update 26 and the Generic Distribution Release), and Microsoft SQL Server 2025 (Cumulative Update 8 and the Generic Distribution Release) on 64‑bit systems.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity, and the vulnerability is exploitable over the network by any authenticated user with basic database access. Although the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the combination of an advanced privilege escalation path and the lack of a mitigation in widespread deployments means that an attacker who can reach the SQL Server has a realistic chance of escalation. The attack vector is inferred to be remote, requiring network connectivity to the SQL Server instance.
