CVE-2026-40370

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:sql_server_2016:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2016:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*

History

No history.

Information

Published : 2026-05-12 18:17

Updated : 2026-06-18 17:23

NVD link : CVE-2026-40370

Mitre link : CVE-2026-40370

CVE.ORG link : CVE-2026-40370

JSON object : View

Products Affected

microsoft

sql_server_2019
sql_server_2025
sql_server_2016
sql_server_2022
sql_server_2017

CWE

CWE-73

External Control of File Name or Path

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

{"id": "CVE-2026-40370", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40370", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T03:57:25.195979Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 (GDR)", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.0.6490.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack", "versions": [{"status": "affected", "version": "13.0.0", "lessThan": "13.0.7085.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (CU 31)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.3530.2", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2017 (GDR)", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "14.0.2110.2", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (CU 32)", "versions": [{"status": "affected", "version": "15.0.0.0", "lessThan": "15.0.4470.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2019 (GDR)", "versions": [{"status": "affected", "version": "15.0.0", "lessThan": "15.0.2170.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 (GDR)", "versions": [{"status": "affected", "version": "16.0.0", "lessThan": "16.0.1180.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2022 for x64-based Systems (CU 24)", "versions": [{"status": "affected", "version": "16.0.0.0", "lessThan": "16.0.4252.3", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2025 (CU 4)", "versions": [{"status": "affected", "version": "17.0.4040.1", "lessThan": "17.0.4040.1", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)", "versions": [{"status": "affected", "version": "17.0.1050.2", "lessThan": "17.0.1115.1", "versionType": "custom"}], "platforms": ["x64-based Systems"]}]}], "published": "2026-05-12T18:17:16.147", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370", "tags": ["Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-73"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "External control of file name or path in SQL Server allows an authorized attacker to execute code over a network."}], "lastModified": "2026-06-18T17:23:30.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "07504D93-CA3C-49EA-A19E-9FF6E39DA2C2", "versionEndExcluding": "13.0.6490.1", "versionStartIncluding": "13.0.6300.2"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "8788D53F-C70A-4445-A091-0E6F3B3580C2", "versionEndExcluding": "13.0.7085.1", "versionStartIncluding": "13.0.7000.253"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "C57CAA5C-DBA1-4D67-AAE0-C6A140817060", "versionEndExcluding": "14.0.2110.2", "versionStartIncluding": "14.0.1000.169"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "4665DEEC-676A-4569-A186-0CBEC807DB2F", "versionEndExcluding": "14.0.3530.2", "versionStartIncluding": "14.0.3006.16"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "AA2CF0C9-AC74-4170-A3DA-6DBD6B191EE6", "versionEndExcluding": "15.0.2170.1", "versionStartIncluding": "15.0.2000.5"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "8ABD3289-C541-4C60-9F0C-51414D05CCCD", "versionEndExcluding": "15.0.4470.1", "versionStartIncluding": "15.0.4003.23"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "34EB59C6-69B7-4EC2-ABAE-0BD7C8AF0220", "versionEndExcluding": "16.0.1180.1", "versionStartIncluding": "16.0.1000.6"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "AA459F89-6125-4CA4-8376-244CA117BF5D", "versionEndExcluding": "16.0.4252.3", "versionStartIncluding": "16.0.4003.1"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "3354FA6E-48A1-406B-A2CB-DB9B769C7E1B", "versionEndExcluding": "17.0.1115.1", "versionStartIncluding": "17.0.1000.7"}, {"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "6440EDCA-2737-425A-9C84-A775C133C581", "versionEndExcluding": "17.0.4040.1", "versionStartIncluding": "17.0.4006.2"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}