CVE-2025-24999
Published: 12 August 2025
Summary
CVE-2025-24999 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 33.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved access authorizations to mitigate the improper access control allowing privilege escalation in SQL Server.
Applies least privilege to restrict low-privileged attackers from elevating to higher privileges over the network.
Remediates the specific SQL Server vulnerability through timely patching as recommended by the Microsoft advisory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via network-accessible improper access control flaw in SQL Server matches Exploitation for Privilege Escalation.
NVD Description
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2025-24999 is an improper access control vulnerability (CWE-284) in SQL Server that enables an authorized attacker to elevate privileges over a network. Published on 2025-08-12T18:15:27.500, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by an attacker with low privileges (PR:L) who has network access (AV:N) to the affected SQL Server instance, requiring low complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows privilege escalation within the unchanged scope (S:U), potentially granting the attacker high-level control over the system, including unauthorized data access, modification, or disruption.
For mitigation details, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24999, which provides guidance on patches and workarounds.
Details
- CWE(s)