12 matches found
CVE-2026-40370
CVE-2026-40370 is a SQL Server Remote Code Execution vulnerability described across multiple sources as external control of a file name or path that can allow an authorized attacker to run code over the network. Connected documents enumerate affected SQL Server components and versions (e.g., SQL ...
CVE-2026-47295
CVE-2026-47295 describes an elevation-of-privilege vulnerability in Microsoft SQL Server caused by improper neutralization of special elements used in SQL commands (SQL injection). The issue can be exploited by an authenticated attacker over a network to gain elevated privileges, with impact on c...
CVE-2026-26115
CVE-2026-26115: Microsoft SQL Server Elevation of Privilege due to improper validation of input. Affects Microsoft SQL Server; vulnerability is exploitable over a network by an authorized attacker with LOW privileges; CVSS v3.1 base score 8.8 (High). Connected sources also reference related bugs ...
CVE-2026-54117
Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...
CVE-2026-47296
CVE-2026-47296 is an elevation-of-privilege vulnerability in Microsoft SQL Server caused by improper neutralization of special elements used in a SQL command (SQL injection). An authorized attacker operating locally with low privileges and no user interaction can escalate privileges (impacting co...
CVE-2026-32167
CVE-2026-32167 is a SQL Server Elevation of Privilege vulnerability caused by improper neutralization of input in SQL commands. An authorized local attacker could elevate privileges. Microsoft security updates address this CVE (e.g., KB5084815/KB5084816 for SQL Server 2022/2019 CU releases; relat...
CVE-2026-21262
CVE-2026-21262 affects Microsoft SQL Server and is a privilege-escalation vulnerability caused by improper access control. An authorized, network-present attacker with low privileges can elevate to sysadmin, potentially reading/changing data, creating accounts, or altering configurations, as desc...
CVE-2026-33120
CVE-2026-33120 affects Microsoft SQL Server and is a remote code execution vulnerability. The entry documents a network-based exploit with low attack complexity and low privileges required, resulting in high impact to confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8 (...
CVE-2026-32176
CVE-2026-32176 arises from improper neutralization of input in SQL Server, enabling an authorized local user to elevate privileges. Connected sources confirm this is one of multiple SQL Server elevation-of-privilege issues addressed in the Microsoft April 2026 security updates (e.g., KB5084815 fo...
CVE-2026-54118
Microsoft SQL Server (2019, 2022, 2025) is vulnerable to deserialization of untrusted data leading to remote code execution (CVSS 9.8, no authentication required). No in-the-wild exploitation is reported (SSVC: Exploitation none). Microsoft released July 14, 2026 patches: KB5101346 (SQL 2025 CU6)...
CVE-2026-26116
CVE-2026-26116 is a SQL Server Elevation of Privilege vulnerability due to improper neutralization of special elements in SQL commands. Affected product: Microsoft SQL Server (SQL Server 2025 GDR) with potential network‑based exploitation and high impact (CVE-2026-26116). The issue is mitigated b...