CVE-2026-32167

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Score

CVSS 3.1 7.8 High

Status

Analyzed - secure@microsoft.com

Published

2026-04-14

Last modified

2026-10-26

Weaknesses

CWE-89

Affected products

• Sql Server 2016 (Microsoft)
• Sql Server 2017 (Microsoft)
• Sql Server 2019 (Microsoft)
• Sql Server 2022 (Microsoft)
• Sql Server 2025 (Microsoft)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167