CVE-2025-53727
published 2025-08-12CVE-2025-53727: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.09%
61.6th percentile
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0.0 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0.0 < 16.0.4210.1 | 16.0.4210.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6465.1 | 13.0.6465.1 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7060.1 | 13.0.7060.1 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2080.1 | 14.0.2080.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3500.1 | 14.0.3500.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2140.1 | 15.0.2140.1 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4440.1 | 15.0.4440.1 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1145.1 | 16.0.1145.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4210.1 | 16.0.4210.1 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker exploits the vulnerability by injecting arbitrary T-SQL commands via a crafted malicious database name — monitor SQL Server audit logs for anomalous or unexpected database name strings containing SQL metacharacters or T-SQL syntax. ↗
- →Successful exploitation results in sysadmin privilege escalation — alert on unexpected additions to the sysadmin fixed server role or sudden privilege elevation for non-admin SQL logins. ↗
- →Exploitation vector is network-based by an authorized (authenticated) attacker — correlate with authenticated SQL Server sessions originating from unexpected hosts or performing unusual DDL/privilege operations. ↗
- ·Vulnerability affects SQL Server 2016 SP3, 2017, 2019, and 2022 across both RTM+GDR and CU update paths — ensure patched versions are deployed: SQL 2022 ≥ 16.0.4210.1 (CU) or 16.0.1145.1 (GDR), SQL 2019 ≥ 15.0.4440.1 (CU) or 15.0.2140.1 (GDR), SQL 2017 ≥ 14.0.3500.1 (CU) or 14.0.2080.1 (GDR), SQL 2016 SP3 ≥ 13.0.6465.1 (GDR) or 13.0.7060.1 (Azure Connect FP). ↗
- ·Exploit status is currently 'Exploitation Less Likely' with no public exploit or in-the-wild exploitation confirmed at time of advisory — prioritize patching but no immediate emergency IOC hunting required. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m89q-9xxf-mgvh: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
ghsa_unreviewed·2025-08-12
CVE-2025-53727 [HIGH] CWE-89 GHSA-m89q-9xxf-mgvh: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Microsoft
Microsoft SQL Server Elevation of Privilege Vulnerability
vendor_msrc·2025-08-12·CVSS 8.8
CVE-2025-53727 [HIGH] CWE-89 Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
Description: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
FAQ: How could an attacker exploit the vulnerability?
An attacker could inject arbitrary T-SQL commands by crafting a malicious database name.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain sysadmin privileges.
FAQ: I am running SQL Server on my system. What action do I need to take?
Update your relevant version of SQL Server. Any applicable driver fixes are included in those updates.
There are GDR and/or CU (Cumulative Update) update
No detection rules found.
No public exploits indexed.
2025-08-12
Published