VDB

CVE-2026-47296

CVE-2026-47296 PUBLISHED CVSS 7.5 HIGH

Reported by microsoft · Published July 14, 2026

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 (GDR)13.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack13.0.0
MicrosoftMicrosoft SQL Server 2017 (CU 31)14.0.0
MicrosoftMicrosoft SQL Server 2017 (GDR)14.0.0
MicrosoftMicrosoft SQL Server 2019 (CU 32)15.0.0.0
MicrosoftMicrosoft SQL Server 2019 (GDR)15.0.0
MicrosoftMicrosoft SQL Server 2022 (GDR)16.0.0
MicrosoftMicrosoft SQL Server 2022 for x64-based Systems (CU 25)16.0.4260.1
MicrosoftMicrosoft SQL Server 2025 (CU 6)17.0.4060.2
MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR)17.0.1050.2
MicrosoftMicrosoft SQL Server 2017 (GDR)14.0.0, 14.0.0, 14.0.0
MicrosoftMicrosoft SQL Server 2022 (GDR)16.0.0, 16.0.0, 16.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack13.0.0, 13.0.0, 13.0.0
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 (GDR)13.0.0, 13.0.0, 13.0.0
microsoftsql_server_201915.0.0.0, 15.0.0, 15.0.0.0
MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR)17.0.1050.2, 17.0.1050.2, 17.0.1050.2
MicrosoftMicrosoft SQL Server 2019 (CU 32)15.0.0.0, 15.0.0.0, 15.0.0.0
MicrosoftMicrosoft SQL Server 2017 (CU 31)14.0.0, 14.0.0, 14.0.0
microsoftsql_server_201613.0.0, 13.0.0, 13.0.0
MicrosoftMicrosoft SQL Server 2025 (CU 6)17.0.4060.2, 17.0.4060.2, 17.0.4060.2

…and 5 more

Timeline

  • Jul 14, 2026 CVE Published
  • Jul 15, 2026 Coalition ESS Score
  • Jul 15, 2026 Security Advisory
  • Aug 5, 2026 Security Advisory
  • Aug 7, 2026 EPSS Score
  • Aug 9, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›