{"uuid": "122e5afe-0156-4835-af9f-fc0a1e1aea74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-47296", "type": "seen", "source": "https://gist.github.com/alon710/b22bbe2f241e5aee1cd66aaa6dd091ce", "content": "# CVE-2026-47296: CVE-2026-47296: Elevation of Privilege via SQL Injection in Microsoft SQL Server Internal Stored Procedures\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-47296\n\n## Summary\nCVE-2026-47296 is a high-severity local Elevation of Privilege (EoP) vulnerability in Microsoft SQL Server. The issue stems from the improper neutralization of special elements within internal database routines, allowing a low-privileged authenticated user to execute arbitrary database queries with the privileges of the database owner or system administrator. Microsoft has addressed this vulnerability in its July 2026 security updates.\n\n## TL;DR\nAn authenticated, low-privileged local attacker can exploit SQL command injection in SQL Server's internal administrative procedures to escalate privileges to sysadmin, gaining complete administrative control over the affected database instance.\n\n## Technical Details\n\n- **CWE ID**: CWE-89 (SQL Injection)\n- **Attack Vector**: Local (Authenticated)\n- **CVSS v3.1 Base Score**: 7.8\n- **EPSS Score**: 0.00232\n- **Impact Type**: Privilege Escalation (up to sysadmin)\n- **Exploit Status**: none (no public PoC available)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft SQL Server 2016\n- Microsoft SQL Server 2017\n- Microsoft SQL Server 2019\n- Microsoft SQL Server 2022\n- Microsoft SQL Server 2025\n- **SQL Server 2025**: >= 17.0.1000.7 and < 17.0.1125.2 (GDR) (Fixed in: `17.0.1125.2`)\n- **SQL Server 2022**: >= 16.0.1000.6 and < 16.0.1190.2 (GDR) (Fixed in: `16.0.1190.2`)\n- **SQL Server 2019**: >= 15.0.2000.5 and < 15.0.2180.2 (GDR) (Fixed in: `15.0.2180.2`)\n- **SQL Server 2017**: >= 14.0.1000.169 and < 14.0.2120.1 (GDR) (Fixed in: `14.0.2120.1`)\n- **SQL Server 2016 SP3**: >= 13.0.6300.2 and < 13.0.6500.1 (GDR) (Fixed in: `13.0.6500.1`)\n\n## Mitigation\n\n- Apply security updates released by Microsoft during the July 2026 release cycle\n- Establish rigid access control lists (ACLs) to restrict access to internal database schemas and system stored procedures\n- Disable execution context switching (EXECUTE AS) for unvetted system or custom procedures\n- Implement rigorous database auditing to detect role membership modifications\n\n**Remediation Steps:**\n1. Identify the patch level of all active SQL Server instances by executing: SELECT @@VERSION;\n2. Download the corresponding Cumulative Update (CU) or General Distribution Release (GDR) package from the Microsoft Update Catalog\n3. Apply the security update to the instance during a scheduled maintenance window\n4. Verify the update build number aligns with the official fixed versions listed in the vendor advisory\n\n## References\n\n- [Microsoft Security Response Center (MSRC) Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47296)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-47296)\n- [National Vulnerability Database (NVD) Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-47296)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-47296) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T11:01:19.962012Z"}