CVE-2026-47296: CVE-2026-47296: Elevation of Privilege via SQL Injection in Microsoft SQL Server Internal Stored Procedures

#security #cve #cybersecurity

CVE-2026-47296: Elevation of Privilege via SQL Injection in Microsoft SQL Server Internal Stored Procedures

Vulnerability ID: CVE-2026-47296
CVSS Score: 7.8
Published: 2026-07-14

CVE-2026-47296 is a high-severity local Elevation of Privilege (EoP) vulnerability in Microsoft SQL Server. The issue stems from the improper neutralization of special elements within internal database routines, allowing a low-privileged authenticated user to execute arbitrary database queries with the privileges of the database owner or system administrator. Microsoft has addressed this vulnerability in its July 2026 security updates.

TL;DR

An authenticated, low-privileged local attacker can exploit SQL command injection in SQL Server's internal administrative procedures to escalate privileges to sysadmin, gaining complete administrative control over the affected database instance.

Technical Details

CWE ID: CWE-89 (SQL Injection)
Attack Vector: Local (Authenticated)
CVSS v3.1 Base Score: 7.8
EPSS Score: 0.00232
Impact Type: Privilege Escalation (up to sysadmin)
Exploit Status: none (no public PoC available)
CISA KEV Status: Not Listed

Affected Systems

Microsoft SQL Server 2016
Microsoft SQL Server 2017
Microsoft SQL Server 2019
Microsoft SQL Server 2022
Microsoft SQL Server 2025
SQL Server 2025: >= 17.0.1000.7 and < 17.0.1125.2 (GDR) (Fixed in: 17.0.1125.2)
SQL Server 2022: >= 16.0.1000.6 and < 16.0.1190.2 (GDR) (Fixed in: 16.0.1190.2)
SQL Server 2019: >= 15.0.2000.5 and < 15.0.2180.2 (GDR) (Fixed in: 15.0.2180.2)
SQL Server 2017: >= 14.0.1000.169 and < 14.0.2120.1 (GDR) (Fixed in: 14.0.2120.1)
SQL Server 2016 SP3: >= 13.0.6300.2 and < 13.0.6500.1 (GDR) (Fixed in: 13.0.6500.1)

Mitigation Strategies

Apply security updates released by Microsoft during the July 2026 release cycle
Establish rigid access control lists (ACLs) to restrict access to internal database schemas and system stored procedures
Disable execution context switching (EXECUTE AS) for unvetted system or custom procedures
Implement rigorous database auditing to detect role membership modifications

Remediation Steps:

Identify the patch level of all active SQL Server instances by executing: SELECT @@version;
Download the corresponding Cumulative Update (CU) or General Distribution Release (GDR) package from the Microsoft Update Catalog
Apply the security update to the instance during a scheduled maintenance window
Verify the update build number aligns with the official fixed versions listed in the vendor advisory