High severity · published Apr 14, 2026
CVE-2026-32176
SQL Server Elevation of Privilege Vulnerability
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Microsoft SQL Server 2016 Service Pack 3 (GDR) · Microsoft
13.0.0 before 13.0.6485.1 · source: vendor
MS
Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack · Microsoft
13.0.0 before 13.0.7080.1 · source: vendor
MS
Microsoft SQL Server 2017 (CU 31) · Microsoft
14.0.0 before 14.0.3525.1 · source: vendor
MS
Microsoft SQL Server 2017 (GDR) · Microsoft
14.0.0 before 14.0.2105.1 · source: vendor
MS
Microsoft SQL Server 2017 for x64-based Systems (CU31) · Microsoft
14.0.3006.16 before 14.0.3560.2 · source: vendor
MS
Microsoft SQL Server 2019 (CU 32) · Microsoft
15.0.0.0 before 15.0.4465.1 · source: vendor
MS
Microsoft SQL Server 2019 (GDR) · Microsoft
15.0.0 before 15.0.2165.1 · source: vendor
MS
Microsoft SQL Server 2022 (GDR) · Microsoft
16.0.0 before 16.0.1175.1 · source: vendor
MS
Microsoft SQL Server 2022 for x64-based Systems (CU 24) · Microsoft
16.0.0.0 before 16.0.4250.1 · source: vendor
MS
Microsoft SQL Server 2022 for x64-based Systems (CU27) · Microsoft
16.0.4003.1 before 16.0.4305.5 · source: vendor
MS
Microsoft SQL Server 2025 (CU 3) · Microsoft
17.0.4030.1 before 17.0.4030.1 · source: vendor
MS
Microsoft SQL Server 2025 for x64-based Systems (CU9) · Microsoft
17.0.4006.2 before 17.0.5015.4 · source: vendor
Affected product
MS
Microsoft SQL Server 2016 Service Pack 3 (GDR)
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32176
Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176
More from Microsoft SQL Server 2016 Service Pack 3 (GDR)
9.8
CVE-2026-54118
Microsoft SQL Server Remote Code Execution Vulnerability
9.8
CVE-2024-37980
Microsoft SQL Server Elevation of Privilege Vulnerability
9.8
CVE-2024-37341
Microsoft SQL Server Elevation of Privilege Vulnerability
8.8
CVE-2026-47295
Microsoft SQL Server Elevation of Privilege Vulnerability
8.8
CVE-2026-55002
Microsoft SQL Server Elevation of Privilege Vulnerability