{"uuid": "fe5d4eae-836b-4c0a-b0a8-c55dd5163d03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47295", "type": "seen", "source": "https://gist.github.com/alon710/3b6e218ec0b0dad08bac52f3df60b532", "content": "# CVE-2026-47295: CVE-2026-47295: SQL Injection and Privilege Escalation in Microsoft SQL Server\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-47295\n\n## Summary\nCVE-2026-47295 is a high-severity elevation of privilege vulnerability in Microsoft SQL Server (2016 through 2025). An authenticated, low-privileged attacker can execute remote SQL injection commands within system stored procedures to elevate permissions to sysadmin.\n\n## TL;DR\nAn authenticated, low-privileged network attacker can execute SQL injection attacks against internal system stored procedures in Microsoft SQL Server, leading to full privilege escalation up to sysadmin administrative control.\n\n## Technical Details\n\n- **CWE ID**: CWE-89 (SQL Injection)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.8\n- **EPSS Score**: 0.00921 (0.92%)\n- **Impact**: Complete Privilege Escalation to sysadmin\n- **Exploit Status**: None (Theoretical)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft SQL Server 2016\n- Microsoft SQL Server 2017\n- Microsoft SQL Server 2019\n- Microsoft SQL Server 2022\n- Microsoft SQL Server 2025\n- **SQL Server 2016 Service Pack 3**: >= 13.0.0 < 13.0.6500.1 (Fixed in: `13.0.6500.1`)\n- **SQL Server 2017**: >= 14.0.0 < 14.0.2120.1 (Fixed in: `14.0.2120.1`)\n- **SQL Server 2019**: >= 15.0.0 < 15.0.2180.2 (Fixed in: `15.0.2180.2`)\n- **SQL Server 2022**: >= 16.0.0 < 16.0.1190.2 (Fixed in: `16.0.1190.2`)\n- **SQL Server 2025**: >= 17.0.0 < 17.0.1125.2 (Fixed in: `17.0.1125.2`)\n\n## Mitigation\n\n- Apply the official GDR and Cumulative Update patches provided by Microsoft.\n- Isolate the SQL Server port interfaces behind local firewalls to prevent raw network access.\n- Revoke EXECUTE permissions from public roles on administrative system procedures.\n- Enable SQL Server Audit mechanisms to detect unauthorized role modifications.\n\n**Remediation Steps:**\n1. Determine the installed edition and version level of the SQL Server database instance.\n2. Download the matching security update package from the Microsoft Update Catalog.\n3. Schedule database maintenance windows and apply the cumulative or GDR patch.\n4. Verify that the database build version matches the patched threshold.\n5. Configure Extended Events or Server Audits to monitor for administrative role promotions.\n\n## References\n\n- [Microsoft Security Response Center (MSRC) Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47295)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-47295)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-47295)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-47295) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T11:01:21.708995Z"}