CVE-2026-47295
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
An SQL injection vulnerability in SQL Server. Improper neutralization of special elements used in an SQL command allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authorized attacker can escalate privileges, potentially leading to unauthorized data access or database takeover.
Recommendation
Apply the appropriate Microsoft patch for SQL Server that neutralizes SQL injection.
Other vulnerabilities in SQL Server
See all- CVE-2026-54118Critical
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
- CVE-2026-54117Critical
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
- CVE-2026-54116Medium
Access of resource using incompatible type ('type confusion') in SQL Server allows an authenticated attacker to disclose information over a network.
- CVE-2026-50468Medium
A buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
- CVE-2026-55002High
A vulnerability in SQL Server allows an authorized attacker to elevate privileges over a network via external control of file name or path.
- CVE-2026-47296High
A vulnerability in SQL Server due to improper neutralization of special elements in SQL commands (SQL injection) allows an authorized attacker to elevate privileges over a network.
- CVE-2026-40370High
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-33120High
An untrusted pointer dereference vulnerability in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-21262High
A vulnerability in SQL Server allows an authorized attacker to elevate privileges over a network due to improper access control.
- CVE-2026-20803High
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.