Microsoft SQL Server Agent Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft SQL Server Engine when SQL Server Agent incorrectly checks ACLs on atxcore.dll. An attacker could exploit the vulnerability if the attacker’s credentials allow access to an affected SQL server database.

An attacker who successfully exploited the vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.

The security update addresses the vulnerability by correcting how SQL Server Engine handles ACLs.