Microsoft SQL Server Elevation of Privilege Vulnerability Allowing Privilege Escalation via SQL Injection

A vulnerability in Microsoft SQL Server has been identified, allowing authorized attackers to elevate privileges locally through improper neutralization of special elements in SQL commands, leading to SQL injection. This vulnerability affects several versions of SQL Server, including 2016, 2017, 2019, 2022, and 2025.

Impact

Exploitation of this vulnerability could allow an attacker to gain SQL sysadmin privileges.

Remediation

Users can apply the security updates available for their version of SQL Server. These security updates can be downloaded from the Microsoft Update Catalog or through the SQL Server Update Management feature in Azure. Instructions for determining the correct update to apply are available in the Microsoft Security Update Guide.