CVE-2025-59499

High · 8.8

CVSS

8.8

EPSS

1.2%

Published

Nov 11, 2025

CISA due date

—

The record

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected packages

Ecosystem	Package	Introduced	Fixed