CVE-2026-32176
Full vulnerability record from the local CVENow database.
Description
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 18:17:20.013000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-32176",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T18:17:20.013",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally."
},
{
"lang": "es",
"value": "Neutralización incorrecta de elementos especiales utilizados en un comando SQL (’inyección SQL’) en SQL Server permite a un atacante autorizado elevar privilegios localmente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "13.0.0",
"lessThan": "13.0.6485.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "13.0.0",
"lessThan": "13.0.7080.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (CU 31)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "14.0.0",
"lessThan": "14.0.3525.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "14.0.0",
"lessThan": "14.0.2105.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 for x64-based Systems (CU31)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "14.0.3006.16",
"lessThan": "14.0.3560.2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (CU 32)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.0.0",
"lessThan": "15.0.4465.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "15.0.0",
"lessThan": "15.0.2165.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.1175.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 for x64-based Systems (CU 24)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.4250.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 for x64-based Systems (CU27)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "16.0.4003.1",
"lessThan": "16.0.4305.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 (CU 3)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "17.0.4030.1",
"lessThan": "17.0.4030.1",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 for x64-based Systems (CU9)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "17.0.4006.2",
"lessThan": "17.0.5015.4",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "17.0.1050.2",
"lessThan": "17.0.1110.1",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T03:57:07.486601Z",
"id": "CVE-2026-32176",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "13.0.6300.2",
"versionEndExcluding": "13.0.6485.1",
"matchCriteriaId": "8BABE301-AB13-4B54-847B-F67EC92CD96C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "13.0.7000.253",
"versionEndExcluding": "13.0.7080.1",
"matchCriteriaId": "31FD6563-A0B9-48C9-BA0B-BF256BFC466D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "14.0.1000.169",
"versionEndExcluding": "14.0.2105.1",
"matchCriteriaId": "02D807B3-0DE8-4E79-AE5A-574AD32834D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "14.0.3006.16",
"versionEndExcluding": "14.0.3525.1",
"matchCriteriaId": "F8B94B39-1964-486F-9532-5557C87AFC87"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "15.0.2000.5",
"versionEndExcluding": "15.0.2165.1",
"matchCriteriaId": "EA4AB606-8B66-4C89-8773-4DA1E25FB2AB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "15.0.4003.23",
"versionEndExcluding": "15.0.4465.1",
"matchCriteriaId": "450ADCF3-0476-4CBE-A0F6-28AE90E9E874"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "16.0.1000.6",
"versionEndExcluding": "16.0.1175.1",
"matchCriteriaId": "FE44A0AE-ECDE-4348-923B-205C691E87DA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "16.0.4003.1",
"versionEndExcluding": "16.0.4250.1",
"matchCriteriaId": "4BFEE9EB-DB7B-490D-AF61-A0162F9FE782"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "17.0.1000.7",
"versionEndExcluding": "17.0.1110.1",
"matchCriteriaId": "FC0EA29C-9CF8-4ED7-B726-BBACF39DA1A8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "17.0.4006.2",
"versionEndExcluding": "17.0.4030.1",
"matchCriteriaId": "8220A87D-84FB-43FA-8DF0-2B4D50E69164"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}