SQL Injection Vulnerability in Microsoft SQL Server
CVE-2026-47295
Key Information:
What is CVE-2026-47295?
An improper neutralization of special elements in SQL commands within Microsoft SQL Server can be exploited by an authorized attacker. This vulnerability enables attackers to elevate their privileges over a network, facilitating unauthorized access to sensitive data and potentially compromising the security of the entire database system. It is crucial for organizations using the affected versions of SQL Server to apply security updates as outlined in the vendor’s advisory.
Affected Version(s)
Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6500.1
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7095.1
Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3540.1