Dashboard / CVE-2026-32167

CVE-2026-32167

HIGH
MEDIUM Priority: 0.02 BB Relevance: 41/100
Published: 2026-04-14 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

Weakness Classification (1)

Affected Software (10)

VendorProductVersion
microsoft sql_server_2016 13.0.6300.2 – 13.0.6485.1
microsoft sql_server_2016 13.0.7000.253 – 13.0.7080.1
microsoft sql_server_2017 14.0.1000.169 – 14.0.2105.1
microsoft sql_server_2017 14.0.3006.16 – 14.0.3525.1
microsoft sql_server_2019 15.0.2000.5 – 15.0.2165.1
microsoft sql_server_2019 15.0.4003.23 – 15.0.4465.1
microsoft sql_server_2022 16.0.1000.6 – 16.0.1175.1
microsoft sql_server_2022 16.0.4003.1 – 16.0.4250.1
microsoft sql_server_2025 17.0.1000.7 – 17.0.1110.1
microsoft sql_server_2025 17.0.4006.2 – 17.0.4030.1

References & Advisories (1)

Bug Bounty Relevance

41 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.8 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.30%
Raw Score 0.002990
Percentile 22.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00299
2026-10-28
0.00299

Intelligence Sources

nvd ref →

External Links