CVE-2026-67370
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authorized attacker could exploit SQL injection to elevate privileges, potentially leading to unauthorized data access or server takeover.
Recommendation
Apply security patches and review code for safe SQL query handling.
Other vulnerabilities in SQL Server
See all- CVE-2026-67636Critical
An out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-67378Critical
An untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-65669Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-54118Critical
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
- CVE-2026-54117Critical
A vulnerability in SQL Server allows an unauthorized attacker to execute code over a network through deserialization of untrusted data.
- CVE-2026-78456High
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
- CVE-2026-77488Medium
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
- CVE-2026-77487High
SQL Server has improper access control that allows an authorized attacker to elevate privileges over a network.
- CVE-2026-77486High
SQL Server has an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code over a network.
- CVE-2026-77485High
SQL Server has a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS