Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-32176: SQL Server Allows Privilege Escalation via Malicious Input
CVE-2026-32176 · published 6 months ago
Summary
An attacker can use malicious input to gain elevated privileges on a SQL Server database, potentially allowing them to access sensitive data or disrupt operations. This issue affects SQL Server installations and requires immediate attention to prevent unauthorized access. To mitigate this risk, ensure that SQL Server is properly configured to prevent malicious input and consider implementing additional security measures.
What to do
- Update microsoft microsoft sql server 2016 service pack 3 (gdr) to version 13.0.6485.1 or later.
- Update microsoft microsoft sql server 2016 service pack 3 azure connect feature pack to version 13.0.7080.1 or later.
- Update microsoft microsoft sql server 2017 (cu 31) to version 14.0.3525.1 or later.
- Update microsoft microsoft sql server 2017 (gdr) to version 14.0.2105.1 or later.
- Update microsoft microsoft sql server 2019 (cu 32) to version 15.0.4465.1 or later.
- Update microsoft microsoft sql server 2019 (gdr) to version 15.0.2165.1 or later.
- Update microsoft microsoft sql server 2022 (gdr) to version 16.0.1175.1 or later.
- Update microsoft microsoft sql server 2022 for x64-based systems (cu 24) to version 16.0.4250.1 or later.
- Update microsoft microsoft sql server 2025 (cu 3) to version 17.0.4030.1 or later.
- Update microsoft microsoft sql server 2025 for x64-based systems (gdr) to version 17.0.1110.1 or later.
- Update microsoft microsoft sql server 2017 for x64-based systems (cu31) to version 14.0.3560.2 or later.
- Update microsoft microsoft sql server 2022 for x64-based systems (cu27) to version 16.0.4305.5 or later.
- Update microsoft microsoft sql server 2025 for x64-based systems (cu9) to version 17.0.5015.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | sql_server_2016 |
>= 13.0.6300.2, < 13.0.6485.1 >= 13.0.7000.253, < 13.0.7080.1 cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:* |
| microsoft | sql_server_2017 |
>= 14.0.1000.169, < 14.0.2105.1 >= 14.0.3006.16, < 14.0.3525.1 cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* |
| microsoft | sql_server_2019 |
>= 15.0.2000.5, < 15.0.2165.1 >= 15.0.4003.23, < 15.0.4465.1 cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* |
| microsoft | sql_server_2022 |
>= 16.0.1000.6, < 16.0.1175.1 >= 16.0.4003.1, < 16.0.4250.1 cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:* |
| microsoft | sql_server_2025 |
>= 17.0.1000.7, < 17.0.1110.1 >= 17.0.4006.2, < 17.0.4030.1 cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:* |
| microsoft | microsoft sql server 2016 service pack 3 (gdr) | < 13.0.6485.1 |
| microsoft | microsoft sql server 2016 service pack 3 azure connect feature pack | < 13.0.7080.1 |
| microsoft | microsoft sql server 2017 (cu 31) | < 14.0.3525.1 |
| microsoft | microsoft sql server 2017 (gdr) | < 14.0.2105.1 |
| microsoft | microsoft sql server 2019 (cu 32) | < 15.0.4465.1 |
| microsoft | microsoft sql server 2019 (gdr) | < 15.0.2165.1 |
| microsoft | microsoft sql server 2022 (gdr) | < 16.0.1175.1 |
| microsoft | microsoft sql server 2022 for x64-based systems (cu 24) | < 16.0.4250.1 |
| microsoft | microsoft sql server 2025 (cu 3) | < 17.0.4030.1 |
| microsoft | microsoft sql server 2025 for x64-based systems (gdr) | < 17.0.1110.1 |
| microsoft | microsoft sql server 2017 for x64-based systems (cu31) | < 14.0.3560.2 |
| microsoft | microsoft sql server 2022 for x64-based systems (cu27) | < 16.0.4305.5 |
| microsoft | microsoft sql server 2025 for x64-based systems (cu9) | < 17.0.5015.4 |
Original advisory text
SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
7.8
High
Type
CWE-89SQL Injection
Timeline
Published14 Apr 2026
Updated4 Nov 2026
First seen14 Apr 2026
Track software like this
Free during beta