Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

TACTICThreat Analysis & Cyber Threat Intelligence Center
System themeFrançais

Back to the watch

CVE-2026-47296

Microsoft SQL Server 2016 Service Pack 3 (GDR)

NormalCVSS 7.5 v3.1

Why this priority

?

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

  • Score CVSS élevé (7.0 ou plus)

Description

This source does not allow its text to be republished here. Read the record at the source.

Affected products

VendorProductVersions
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 (GDR)
  • from 13.0.0 to 13.0.6500.1 excluded
MicrosoftMicrosoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
  • from 13.0.0 to 13.0.7095.1 excluded
MicrosoftMicrosoft SQL Server 2017 (CU 31)
  • from 14.0.0 to 14.0.3540.1 excluded
MicrosoftMicrosoft SQL Server 2017 (GDR)
  • from 14.0.0 to 14.0.2120.1 excluded
MicrosoftMicrosoft SQL Server 2019 (CU 32)
  • from 15.0.0.0 to 15.0.4480.2 excluded
MicrosoftMicrosoft SQL Server 2019 (GDR)
  • from 15.0.0 to 15.0.2180.2 excluded
MicrosoftMicrosoft SQL Server 2022 (GDR)
  • from 16.0.0 to 16.0.1190.2 excluded
MicrosoftMicrosoft SQL Server 2022 for x64-based Systems (CU 25)
  • from 16.0.4260.1 to 16.0.4262.2 excluded
MicrosoftMicrosoft SQL Server 2025 (CU 6)
  • from 17.0.4060.2 to 17.0.4060.2 excluded
MicrosoftMicrosoft SQL Server 2025 for x64-based Systems (GDR)
  • from 17.0.1050.2 to 17.0.1125.2 excluded

Revision history

  1. Revision 2

  2. Revision 1

    New record

Qualification

CVSS severity
?

Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary

7.5 HIGH CVSS v3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KEV catalog
?

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary

Unknown
Exploitation
Not reported
EPSS probability
?

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary

Unknown
Confidence
?

Quality of the sources behind the record. It is not a risk score. See the glossary

High

Priority rules, version 1

Record

Published on
14 July 2026
Weaknesses (CWE)
CWE-89

Sources

References

CVE-2026-47296 Microsoft SQL Server 2016 Service Pack 3 (GDR) · Avanguard TACTIC