SQL Server flaw lets insiders boost rights across three major versions
A high-severity buffer overflow in Microsoft SQL Server allows authorised users to escalate privileges, affecting 2017, 2019 and 2022 editions.
Key points
- The vulnerability is rated high severity with a CVSS score of 8.
- It affects SQL Server 2017, 2019 and 2022 versions before specific cumulative updates.
- An authorised attacker can exploit the flaw over a network to gain higher privileges.
Microsoft SQL Server contains a high-severity vulnerability that allows an attacker with existing access to elevate their privileges. According to the official Microsoft Security Update Guide, this stack-based buffer overflow, identified as CVE-2026-96956, enables a user to gain higher-level permissions over a network connection.
The flaw impacts several versions of the database software. According to the National Vulnerability Database, it affects Microsoft SQL Server 2017, 2019 and 2022. Specifically, it targets General Distribution Release and Cumulative Update builds prior to specific version numbers listed in the advisory.
What we know
The vulnerability is classified as a stack-based buffer overflow, which corresponds to weakness CWE-121. According to the NVD record, the issue has a CVSS score of 8, which is rated as high severity. The description states that an authorised attacker can exploit this flaw to elevate privileges.
Affected systems include Microsoft SQL Server 2017 (GDR) before version 14.0.2140.2 and SQL Server 2017 for x64-based systems (CU31) before version 14.0.3560.2. These specific version thresholds determine whether a system is vulnerable or patched.
Microsoft SQL Server 2019 is also affected. According to the source material, this includes the 2019 (GDR) version before 15.0.2200.2 and the 2019 for x64-based systems (CU32) before version 15.0.4500.2. Organisations running these older builds are exposed to the privilege escalation risk.
The 2022 edition faces similar exposure. The advisory lists Microsoft SQL Server 2022 (GDR) before version 16.0.1210.3 as vulnerable. Additionally, Microsoft SQL Server 2022 for x64-based systems (CU27) before version 16.0.4305.5 is included in the list of affected configurations.
Defender's checklist
- Verify the current version of all SQL Server instances against the affected lists.
- Identify any accounts that have existing access to the database over the network.
- Review recent logs for unusual privilege escalation attempts or unexpected access changes.
- Confirm that no unauthorised users have gained higher-level permissions recently.
The background in plain language
A buffer overflow occurs when a program writes more data to a memory space than it can hold. This can overwrite adjacent memory, potentially allowing an attacker to execute arbitrary code or change how the software behaves. Privilege escalation means a user gains more access rights than they originally had. In this context, an authorised user is someone who already has legitimate login credentials, but the flaw allows them to bypass normal restrictions and take on higher-level administrative roles.
Background: Privilege escalation vulnerabilities
Detect privilege escalation by correlating authentication logs with file permission changes and process creation events. Look for unusual parent-child process relationships, unexpected service account usage and deviations from baseline behaviour. Use endpoint detection platforms to catch runtime anomalies that static scans miss.
Read the full guide: Detect Privilege Escalation: Signals, Tools and Blind Spots
What to do and how to stay safe: Microsoft SQL Server
- Audit all database accounts to ensure they have only the minimum necessary permissions.
- Monitor network traffic to and from SQL Server instances for unusual activity patterns.
- Check current software versions against the advisory to identify if systems are vulnerable.
- Prepare to apply updates once the vendor provides a confirmed fix for the issue.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this SQL Server vulnerability?
The vulnerability is identified as CVE-2026-96956 according to the Microsoft Security Update Guide.
Which SQL Server versions are affected by this flaw?
It affects SQL Server 2017, 2019 and 2022 versions before specific cumulative updates and general distribution releases.
What type of vulnerability is this?
It is a stack-based buffer overflow that allows an authorised attacker to elevate privileges over a network.
