CVE-2026-32176

CVE-2026-32176 is a SQL injection vulnerability in SQL Server that permits an authorized local attacker to elevate privileges through improper neutralization of special elements in SQL commands. The vulnerability affects SQL Server and requires high privileges to exploit, though successful exploitation can lead to complete compromise of confidentiality, integrity, and availability. The vulnerability carries a CVSS score of 6.7 (MEDIUM severity) with a local attack vector, low attack complexity, and high-privilege requirement. The impact assessment is severe, with potential for high-impact confidentiality, integrity, and availability breaches once an attacker gains the necessary local access and elevated permissions. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. However, the FAUCET risk score of 45.0 and EPSS score suggest moderate community attention and warrant monitoring for future exploit development.