High · published September 8, 2026
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/sql_server_2017 | < 14.0.2130.4 | 14.0.2130.4 |
| microsoft/sql_server_2017 | ≥ 14.0.3006.16, < 14.0.3550.4 | 14.0.3550.4 |
| microsoft/sql_server_2019 | < 15.0.2190.7 | 15.0.2190.7 |
| microsoft/sql_server_2019 | ≥ 15.0.4003.23, < 15.0.4490.9 | 15.0.4490.9 |
| microsoft/sql_server_2022 | < 16.0.1200.5 | 16.0.1200.5 |
| microsoft/sql_server_2022 | ≥ 16.0.4003.1, < 16.0.4275.2 | 16.0.4275.2 |
| microsoft/sql_server_2025 | < 17.0.1135.8 | 17.0.1135.8 |
| microsoft/sql_server_2025 | ≥ 17.0.4006.2, < 17.0.4085.5 | 17.0.4085.5 |