SQL Server Elevation of Privilege Vulnerability in Microsoft Products
CVE-2026-47296

7.8HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2016 Service Pack 3 (gdr); Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack; Microsoft Sql Server 2017 (cu 31); Microsoft Sql Server 2017 (gdr)
Vendor: CVE Published:; 14 July 2026

What is CVE-2026-47296?

An SQL injection vulnerability present in Microsoft SQL Server can allow an authorized attacker to execute arbitrary SQL commands. By improperly neutralizing special characters within SQL commands, this flaw enables privilege escalation on the affected system. Administrators should apply the latest patches to safeguard their databases and maintain security integrity against potential attacks.

Affected Version(s)

Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6500.1

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7095.1

Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3540.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

7.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 14, 2026
Vulnerability Reserved
May 18, 2026

CVE-2026-47296 Data

JSON