medium6.7
CVE-2026-32176
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Impact
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Sql Server 2016 | from 13.0.6300.2 before 13.0.6485.1 from 13.0.7000.253 before 13.0.7080.1 |
| Microsoft | Sql Server 2017 | from 14.0.1000.169 before 14.0.2105.1 from 14.0.3006.16 before 14.0.3525.1 |
| Microsoft | Sql Server 2019 | from 15.0.2000.5 before 15.0.2165.1 from 15.0.4003.23 before 15.0.4465.1 |
| Microsoft | Sql Server 2022 | from 16.0.1000.6 before 16.0.1175.1 from 16.0.4003.1 before 16.0.4250.1 |
| Microsoft | Sql Server 2025 | from 17.0.1000.7 before 17.0.1110.1 from 17.0.4006.2 before 17.0.4030.1 |