Microsoft SQL Server: Elevation of privilege via exposed dangerous method
Summary
A flaw in Microsoft SQL Server exposes a dangerous method or function (CWE-749) that allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privileged login and the attack complexity is high. Successful exploitation could affect confidentiality, integrity and availability of the database server.
Affected
- SQL Server 2017 GDR: 14.0.0 to before 14.0.2150.2
- SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to before 14.0.3570.2
- SQL Server 2019 GDR: 15.0.0 to before 15.0.2210.4
- SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to before 15.0.4510.2
- SQL Server 2022 GDR: 16.0.0 to before 16.0.1220.3
- SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to before 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to before 17.0.5045.3
- SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to before 17.0.1155.3 (MSRC table lists 17.0.1000.7 to 17.0.1145.4 for the RTM GDR range; verify)
Fixed in
- SQL Server 2025 CU10+GDR: 17.0.5045.3 (update 5129299)
- SQL Server 2025 RTM+GDR: 17.0.1155.3 (update 5132748)
- SQL Server 2022 CU27+GDR2: 16.0.4315.2 (update 5129300)
- SQL Server 2022 RTM+GDR: 16.0.1220.3 (update 5132747)
- Fixed builds for SQL Server 2017 GDR (14.0.2150.2) and 2019 CU32 (15.0.4510.2) are listed in the CVE record; builds for 2017 CU31 (14.0.3570.2) and 2019 GDR (15.0.2210.4) are unconfirmed on the MSRC page
Workaround
No vendor-documented workaround found. Microsoft directs customers to install the applicable November 2026 security update.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept found.
- CVE record exploit maturity: Unproven (E:U).
Our recommendation
- Inventory all SQL Server instances and their versions, including GDR and CU level.
- Apply the matching November 2026 security update, starting with internet-reachable or sensitive instances.
- Confirm the build number after patching.
- Restrict network access to SQL Server ports to application servers only.
- Review which accounts hold logins on each instance and remove unneeded low-privileged access.
- Do not expose SQL Server to the internet.
- Check the MSRC page and NVD for updates, as NVD status was still Awaiting Analysis.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-84010 msrc.microsoft.com
- CVE Record CVE-2026-84010 www.cve.org
- KB5132748 SQL Server 2025 GDR November 2026 support.microsoft.com
- VulDB CVE-2026-84010 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:10.
Original description (NVD)
Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.