Microsoft SQL Server Vulnerability Allows Privilege Escalation

Microsoft has disclosed a critical SQL injection vulnerability in SQL Server that could allow authenticated attackers to escalate their privileges over a network, tracked as CVE-2025-59499 with an Important severity rating. The flaw stems from improper neutralization of special elements in SQL commands and is classified under CWE-89, with a CVSS 3.1 score ranging from 7.7 to 8.8.

It operates over a network and can be exploited remotely by an attacker with valid SQL Server credentials, requiring low complexity and no user interaction. According to Microsoft, this combination of network accessibility, credential requirements, and high impact makes it an attractive target for threat actors who have compromised legitimate accounts, though initial assessments suggested exploitation is less likely.

The advisory recommends patching affected instances, reviewing access controls, and enforcing principle-of-least-privilege policies, alongside monitoring logs for suspicious queries and privilege escalation attempts.