CVE-2026-40370CWE-73

SQL Server Remote Code Execution Vulnerability

High · published May 12, 2026

CVSS v3.1

8.8

EPSS

1%

Percentile

62.8

In the wild

Unconfirmed

What it is

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0: Not supplied
EPSS: 0.01010 · 62.8th percentile
Weakness: CWE-73 · External Control of File Name or Path
Published: 2026-05-12T16:59Z

EPSS history

Timeline

12 MAY 16:59Z
SQL Server Remote Code Execution Vulnerability
cvelistv5