Microsoft SQL Server: Remote code execution via command injection

Summary

Microsoft SQL Server contains a command injection flaw (CWE-77) that allows remote code execution over the network. The CVSS vector (8.8, HIGH) requires no privileges but user interaction, with high impact on confidentiality, integrity and availability. The description speaks of an unauthorized attacker, which conflicts with the user interaction in the vector, so the exact preconditions still need to be confirmed with Microsoft.

Affected

• SQL Server 2017 (GDR): 14.0.0 to before 14.0.2150.2
• SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to before 14.0.3570.2
• SQL Server 2019 (GDR): 15.0.0 to before 15.0.2210.4
• SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to before 15.0.4510.2 (from third-party aggregator, unverified)
• SQL Server 2022 (GDR): 16.0.0 to before 16.0.1220.3 (from third-party aggregator, unverified)
• SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to before 16.0.4315.2 (from third-party aggregator, unverified)
• SQL Server 2025 CU10: 17.0.4006.0 to before 17.0.5045.3 (from third-party aggregator, unverified)
• SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to before 17.0.1155.3 (from third-party aggregator, unverified)

Fixed in

Microsoft has published a fix in its security update of 10 November 2026 (reportedly KB5132748 for SQL Server 2025 GDR). Exact fixed build numbers per branch: Unknown. Check the MSRC advisory for the build list.

Workaround

Unknown. No vendor workaround was found. Patching is the only documented remedy.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• The CVSS vector uses exploit maturity 'unproven'.
• No public proof of concept, Metasploit module or in-the-wild exploitation was found.
• A third-party price estimate exists, which is not evidence of use.

Our recommendation

• Patch SQL Server instances to the build listed in the MSRC advisory for your branch, prioritising instances reachable from the internet.
• Check whether any SQL Server instance is directly exposed, including through port forwarding or VPN misconfiguration, and close unneeded ports.
• Limit the privileges of SQL service accounts and restrict network access to database servers to required segments.
• Monitor for unusual process creation or command execution on database servers.
• Ask Microsoft to clarify whether user interaction is required, to finalise the risk rating.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record (CNA Microsoft) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• VulDB vuldb.com
• Strix CVE details (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:36.