CVE-2026-67370high8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Impact
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Source excerpt · microsoftAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · Microsoft SQL Server 2017 (CU 31)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 14.0.0 to before 14.0.3550.4 | affected |
Microsoft · Microsoft SQL Server 2017 (GDR)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 14.0.0 to before 14.0.2130.4 | affected |
Microsoft · Microsoft SQL Server 2019 (CU 32)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 15.0.0.0 to before 15.0.4490.9 | affected |
Microsoft · Microsoft SQL Server 2019 (GDR)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 15.0.0 to before 15.0.2190.7 | affected |
Microsoft · Microsoft SQL Server 2022 (CU 26)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 16.0.0.0 to before 16.0.4275.2 | affected |
Microsoft · Microsoft SQL Server 2022 (GDR)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 16.0.0 to before 16.0.1200.5 | affected |
Microsoft · Microsoft SQL Server 2025 (CU8)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 17.0.0.0 to before 17.0.4085.5 | affected |
Microsoft · Microsoft SQL Server 2025 for x64-based Systems (GDR)
Platforms: x64-based Systems
| Version / range | Source status |
|---|---|
| 17.0.1050.2 to before 17.0.1135.8 | affected |
Original source description
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.