PT-2025-32772 · Microsoft · Sql Server

Chris Thompson + 1 · Published 2025-08-12 · Updated 2026-01-20 · CVE-2025-49758

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SQL Server (affected versions not specified)

Description The software contains an improper neutralization of special elements in SQL commands, leading to a potential SQL injection issue. This allows an authorized attacker to elevate privileges over a network. Additionally, an elevation-of-privilege issue can allow attackers to affect the system. The vulnerability is related to incorrect privilege assignment within the database management system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-10657

CVE-2025-49758

Affected Products

Sql Server

References · 12

• https://bdu.fstec.ru/vul/CVE-2025-49758 · Security Note
• https://bdu.fstec.ru/vul/2025-10657 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-49758 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49758 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49758 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-49758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49758 · Security Note
• https://t.me/cveNotify/132184 · Telegram Post
• https://twitter.com/CVEnew/status/1955658288520913254 · Twitter Post
• https://twitter.com/SpecterOps/status/2013665351360278884 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1qdp3jz/mssql_and_sccm_elevation_of_privilege · Reddit Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49758 · Note