CVE-2026-40370

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network...

The vulnerability was exploited in Microsoft SQL Server

Microsoft has identified a vulnerability in SQL Server. A malicious individual with authorized access can exploit this vulnerability to execute arbitrary code under the control of the SQL Server. Microsoft has provided updates that address the described vulnerabilities. We recommend that you...

CVE-2026-40370

CVE-2026-40370 is a SQL Server Remote Code Execution vulnerability described across multiple sources as external control of a file name or path that can allow an authorized attacker to run code over the network. Connected documents enumerate affected SQL Server components and versions (e.g., SQL ...

KB5090354 - Description of the security update for SQL Server 2017 CU31: May 12, 2026

None None...

KB5090347 - Description of the security update for SQL Server 2017 GDR: May 12, 2026

None None...

KB5091158 - Description of the security update for SQL Server 2022 GDR: May 12, 2026

None None...

KB5090408 - Description of the security update for SQL Server 2019 GDR: May 12, 2026

None None...

KB5090407 - Description of the security update for SQL Server 2019 CU32: May 12, 2026

None None...

KB5089271 - Description of the security update for SQL Server 2016 SP3 GDR: May 12, 2026

None None...

KB5089899 - Description of the security update for SQL Server 2025 CU4: May 12, 2026

None None...

KB5089900 - Description of the security update for SQL Server 2022 CU24: May 12, 2026

None None...

SQL Server Remote Code Execution Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-40370: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network...

Microsoft SQL Server 安全漏洞

Microsoft SQL Server is a large-scale commercial database system developed by Microsoft Corporation, used under the Microsoft Windows operating system. There are security vulnerabilities in Microsoft SQL Server. Attackers can exploit these vulnerabilities to execute code remotely. The following...

KLA91039 ACE vulnerability in Microsoft SQL Server

A remote code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-40370 Exploitation Related products Microsoft-SQL-Server Microsoft-Azure CVE list CVE-2026-40370 critical KB list 5090354...

CVE-2026-6093 Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server MSSQL backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8...

CVE-2026-6093 Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping

Corteza contains a SQL injection vulnerability in its Microsoft SQL Server MSSQL backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8...

mssql_timebased_SQLI

No d...

Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11: - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictio...

📄 Microsoft SQL Server 2022/2025 Privilege Escalation

This Python script demonstrates a privilege escalation technique targeting Microsoft SQL Server, associated with CVE-2025-24999. The exploit abuses improper permission controls on system stored procedures in the msdb database to elevate a low-privileged account to SYSADMIN...