High WID-SEC-2025-1782 5 CVEs

Microsoft SQL Server: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Published Aug 12, 2025 · Updated Apr 6, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: SQL Server 2016 Product: SQL Server 2017 Product: SQL Server 2019 Product: SQL Server 2022 Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft SQL Server ausnutzen, um seine Privilegien zu erhöhen.

Product

Der Microsoft SQL Server ist ein relationales Datenbankmanagementsystem von Microsoft.

Vulnerabilities 5

High 8.8

CVE-2025-24999 Public exploit

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Aug 12, 2025
High 8.8

CVE-2025-47954

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2022 (CU 20)

Aug 12, 2025
High 8.8

CVE-2025-49758

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Aug 12, 2025
High 8.8

CVE-2025-49759

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Aug 12, 2025
High 8.8

CVE-2025-53727

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Aug 12, 2025

Revision history

2026-04-06 #2
PoC für CVE-2025-24999 aufgenommen
2025-08-12 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
CX Security PoC CVE-2025-24999 vom 2026-04-06
https://cxsecurity.com/issue/WLB-2026040001