Threat Advisory

Microsoft SQL Server Privilege Escalation Vulnerability

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High

EXECUTIVE SUMMARY:

A high-severity privilege escalation vulnerability has been identified in Microsoft SQL Server, tracked as CVE-2025-59499. This flaw allows low-privileged authenticated attackers to execute arbitrary SQL commands and potentially gain elevated privileges over the database instance.

  • CVE-2025-59499: The vulnerability exists due to improper neutralization of special elements in SQL queries, enabling SQL injection through crafted database identifiers or commands. An attacker with basic database access can exploit this issue to run arbitrary T-SQL under the context of the SQL Server service account, which often holds high privileges. This vulnerability affects Microsoft SQL Server 2016, 2017, 2019, and 2022, and carries a CVSS v3.1 score of 8.8 (High).

Exploitation of this flaw could allow attackers to gain administrative-level control of the SQL Server instance, manipulate or exfiltrate sensitive data, create backdoor accounts, or execute further system-level actions, posing significant risks to enterprise database environments.

RECOMMENDATION:

We recommend you refer below mentioned link to apply patches for CVE-2025-59499: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59499

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/microsoft-sql-server-vulnerability/#google_vignette

crossmenu