Medium

SQL Server Elevation of Privilege Vulnerability

Type: advisorySource: Official CVE List1 source record

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Announced 14 Apr 2026Group revision 1

Original source ↗

CVE-2026-32167

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-32167

Microsoft SQL Server 2016 Service Pack 3 (GDR)

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2017 (CU 31)

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2017 (GDR)

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2019 (CU 32)

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2019 (GDR)

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2022 (GDR)

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2022 for x64-based Systems (CU 24)

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2025 (CU 3)

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Microsoft SQL Server 2025 for x64-based Systems (GDR)

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)",
    "versions": [
      {
        "status": "affected",
        "version": "13.0.0",
        "lessThan": "13.0.6485.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack",
    "versions": [
      {
        "status": "affected",
        "version": "13.0.0",
        "lessThan": "13.0.7080.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2017 (CU 31)",
    "versions": [
      {
        "status": "affected",
        "version": "14.0.0",
        "lessThan": "14.0.3525.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2017 (GDR)",
    "versions": [
      {
        "status": "affected",
        "version": "14.0.0",
        "lessThan": "14.0.2105.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2019 (CU 32)",
    "versions": [
      {
        "status": "affected",
        "version": "15.0.0.0",
        "lessThan": "15.0.4465.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2019 (GDR)",
    "versions": [
      {
        "status": "affected",
        "version": "15.0.0",
        "lessThan": "15.0.2165.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2022 (GDR)",
    "versions": [
      {
        "status": "affected",
        "version": "16.0.0",
        "lessThan": "16.0.1175.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2022 for x64-based Systems (CU 24)",
    "versions": [
      {
        "status": "affected",
        "version": "16.0.0.0",
        "lessThan": "16.0.4250.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2025 (CU 3)",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.4030.1",
        "lessThan": "17.0.4030.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.1050.2",
        "lessThan": "17.0.1110.1",
        "versionType": "custom"
      }
    ],
    "platforms": [
      "x64-based Systems"
    ]
  }
]

Related CVEs: CVE-2026-32167
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #29149 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:54:15 GMT
Publisher date: Tue, 14 Apr 2026 16:57:30 GMT

Read the original announcement

Revision history

25 Oct 2026CVE-2026-32167 · Revision 1Source updated