CVE-2025-59499
Published: 11 November 2025
Description
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and neutralization of special elements in inputs to SQL commands, addressing the core cause of this SQL injection vulnerability in SQL Server.
Mandates timely remediation of flaws such as this SQL injection vulnerability through patching as advised by Microsoft.
Enforces least privilege to limit the impact of privilege escalation even if SQL injection succeeds.
Security SummaryAI
CVE-2025-59499 is an SQL injection vulnerability (CWE-89) in Microsoft SQL Server, caused by improper neutralization of special elements used in an SQL command. Published on 2025-11-11T18:15:35.733, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized attacker with low privileges (PR:L) over the network (AV:N), requiring low attack complexity and no user interaction. Successful exploitation allows the attacker to elevate privileges, resulting in high impacts on confidentiality, integrity, and availability.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59499 provides details on advisories and patches for mitigation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability explicitly enables privilege escalation for low-privileged authenticated attackers, directly mapping to T1068: Exploitation for Privilege Escalation.