CVE-2025-49758

Published: Aug 12, 2025Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected (8)

Products: Microsoft: Sql Server 2016, Sql Server 2017, Sql Server 2019, Sql Server 2022

4 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql Server 2016	13.0.6300.2 ≤ version < 13.0.6465.1
Microsoft Sql Server 2016	13.0.7000.253 ≤ version < 13.0.7060.1
Microsoft Sql Server 2017	14.0.1000.169 ≤ version < 14.0.2080.1
Microsoft Sql Server 2017	14.0.3006.16 ≤ version < 14.0.3500.1
Microsoft Sql Server 2019	15.0.2000.5 ≤ version < 15.0.2140.1
Microsoft Sql Server 2019	15.0.4003.23 ≤ version < 15.0.4440.1
Microsoft Sql Server 2022	16.0.1000.6 ≤ version < 16.0.1145.1
Microsoft Sql Server 2022	16.0.4003.1 ≤ version < 16.0.4210.1

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49758

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.