CVE-2025-24999
Published: 12 August 2025
Summary
CVE-2025-24999 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-24999 is an improper access control vulnerability, tracked under CWE-284, that affects Microsoft SQL Server. It carries a CVSS 3.1 base score of 8.8 and permits an authorized attacker to elevate privileges across a network.
An attacker who already possesses valid credentials can exploit the flaw remotely with low attack complexity and no user interaction, resulting in full compromise of confidentiality, integrity, and availability on the affected SQL Server instance.
The sole reference points to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24999, which is the authoritative source for patch and mitigation guidance. The associated EPSS score remains low at 0.0129 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24368
Vulnerability details
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via network-accessible improper access control flaw in SQL Server matches Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved access authorizations to mitigate the improper access control allowing privilege escalation in SQL Server.
Applies least privilege to restrict low-privileged attackers from elevating to higher privileges over the network.
Remediates the specific SQL Server vulnerability through timely patching as recommended by the Microsoft advisory.