SQL Server Privilege Escalation Flaw Affects 2017, 2019, and 2022 Versions

Microsoft has published an official advisory for CVE-2026-96956, a security vulnerability affecting multiple versions of SQL Server. The issue is a stack-based buffer overflow that permits an attacker who already has authorization to elevate their privileges. According to the Microsoft Security Update Guide, this escalation can occur over a network, meaning remote access is a vector for abuse. The vulnerability is classified under CWE-121 weaknesses.

How it unfolded

• Microsoft released the official advisory detailing the elevation of privilege vulnerability.
• The National Vulnerability Database recorded the CVE with a CVSS score of 8.
• Affected product versions were listed as those prior to specific cumulative and general distribution releases.

Who is affected

Organizations running Microsoft SQL Server 2017 are at risk if they use General Distribution Release builds before version 14.0.2140.2. For systems using Cumulative Update 31 on x64-based architectures, the affected builds are those before 14.0.3560.2. SQL Server 2019 users face exposure on GDR builds before 15.0.2200.2 and CU32 builds before 15.0.4500.2 on x64 systems. Microsoft SQL Server 2022 is also vulnerable on GDR builds prior to 16.0.1210.3 and CU27 builds before 16.0.4305.5 on x64-based systems. These specific version thresholds define the boundary between vulnerable and patched software according to the source data.

Our take on the response

The classification of this flaw as high severity indicates significant potential for damage if exploited by an authorized user. The requirement for prior authorization narrows the immediate threat surface compared to unauthenticated remote code execution, but it still represents a critical breach of the principle of least privilege. Managed service providers must treat this as a priority because an attacker with low-level access can potentially gain administrative control. The source material lists specific version updates that address the vulnerability, indicating that patches are available for deployment.

Who needs to act first

Teams should prioritize identifying all SQL Server instances running the vulnerable versions listed in the advisory. Check whether any of these systems are exposed to internal networks where authorized users operate. Evaluate the risk of privilege escalation by reviewing current user permissions and network access rules. Apply the available updates to move systems to the safe versions listed in the advisory. Ensure that monitoring tools are active to detect unusual privilege changes or suspicious network activity that could indicate exploitation attempts.

What to do and how to stay safe: Microsoft

• Audit your inventory to find all SQL Server 2017, 2019, and 2022 instances and verify their current build versions against the affected lists.
• Restrict network access to database servers to only those users and systems that absolutely require connectivity, reducing the pool of potential authorized attackers.
• Monitor logs for any attempts by users to elevate their privileges or access resources beyond their normal scope, which could signal exploitation.
• Deploy the available updates to the affected SQL Server versions as soon as possible to mitigate the risk.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96956?

The National Vulnerability Database rates CVE-2026-96956 as CVSS 8, which is classified as high severity.

Does this vulnerability allow unauthenticated remote exploitation?

No, the source material states that an authorized attacker is required to exploit this stack-based buffer overflow vulnerability.

Which specific SQL Server 2022 versions are vulnerable?

SQL Server 2022 GDR builds before 16.0.1210.3 and CU27 builds before 16.0.4305.5 on x64-based systems are affected.