CVE-2026-32176
published 2026-04-14CVE-2026-32176: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6485.1 | 13.0.6485.1 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7080.1 | 13.0.7080.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3525.1 | 14.0.3525.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2105.1 | 14.0.2105.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2165.1 | 15.0.2165.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0.0 < 15.0.4465.1 | 15.0.4465.1 |
| microsoft | microsoft_sql_server_2022 | >= 16.0.0 < 16.0.1175.1 | 16.0.1175.1 |
| microsoft | microsoft_sql_server_2022_for_x64-based_systems | >= 16.0.0.0 < 16.0.4250.1 | 16.0.4250.1 |
| microsoft | microsoft_sql_server_2025 | >= 17.0.4030.1 < 17.0.4030.1 | 17.0.4030.1 |
| microsoft | microsoft_sql_server_2025_for_x64-based_systems | >= 17.0.1050.2 < 17.0.1110.1 | 17.0.1110.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6485.1 | 13.0.6485.1 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7080.1 | 13.0.7080.1 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2105.1 | 14.0.2105.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3525.1 | 14.0.3525.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2165.1 | 15.0.2165.1 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4465.1 | 15.0.4465.1 |
| microsoft | sql_server_2022 | >= 16.0.1000.6 < 16.0.1175.1 | 16.0.1175.1 |
| microsoft | sql_server_2022 | >= 16.0.4003.1 < 16.0.4250.1 | 16.0.4250.1 |
| microsoft | sql_server_2025 | >= 17.0.1000.7 < 17.0.1110.1 | 17.0.1110.1 |
| microsoft | sql_server_2025 | >= 17.0.4006.2 < 17.0.4030.1 | 17.0.4030.1 |