CVE-2026-32176: SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Other sources
SQL Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.0.6485.1Patch KB5084821 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4250.1Patch KB5083252 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3525.1Patch KB5084818 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.4030.1Patch KB5083245 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.0.7080.1Patch KB5084820 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1175.1Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2165.1Fixed in 15.0.2200.2Patch KB5128495 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4465.1Fixed in 15.0.4500.2Patch KB5128494 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1110.1Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2105.1Fixed in 14.0.2140.2Patch KB5128497 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3560.2Patch KB5128496 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32176?
CVE-2026-32176 has a severity rating that indicates it can allow authorized attackers to elevate privileges in SQL Server.
How do I fix CVE-2026-32176?
To fix CVE-2026-32176, it is recommended to apply the latest security patches provided by Microsoft for affected SQL Server versions.
Which versions of SQL Server are affected by CVE-2026-32176?
CVE-2026-32176 affects multiple versions of SQL Server including 2016, 2017, 2019, 2022, and 2025.
What types of privileges can be elevated due to CVE-2026-32176?
CVE-2026-32176 allows attackers to escalate their privileges to gain higher access levels within the SQL Server environment.
Who is vulnerable to CVE-2026-32176?
Organizations using vulnerable versions of SQL Server without the latest updates are susceptible to CVE-2026-32176.