Read the docs
TI-2022-07400 Aliases CVE-2022-23276GHSA-m74m-wrhv-h6gc

SQL Server for Linux Containers Elevation of Privilege Vulnerability

Priority LOW 35Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

SQL Server for Linux Containers Elevation of Privilege Vulnerability

Why it matters now

EPSS 0.00548 46th percentileScored 2026-11-07
Fix Fixed Microsoft: 1 update

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftSQL Server 2019 for Linux Containers15.0.0 to before 15.0.2090.3815.0.2090.38Patch availableCNA
  • SQL Server 2019 for Linux Containers VendorMicrosoft Affected 15.0.0 to before 15.0.2090.38 Fixed in 15.0.2090.38 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:microsoft:sql_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Microsoft 1 update

  • KB5010657
    Security Update
    • SQL Server 2019 for Linux Containers 15.0.2090.38

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Elevation of Privilege
Exploited
No
Publicly disclosed
—
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23276
  2. 2026-10-03 Alias added: GHSA-m74m-wrhv-h6gc

References

Advisory 1

  • TI-2020-00595 Deserialization of untrusted data in Microsoft SQL Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-00798 Improper input validation in Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems KEVCVSS 3.1HIGH 8.8
  • TI-2012-01640 The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office… KEVCVSS 3.1HIGH 8.8
  • TI-2008-05156 Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and… CVSS 2.0HIGH 9.0
  • TI-2008-00076 Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop… CVSS 2.0HIGH 9.0
  • TI-2002-00627 Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and… CVSS 2.0HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences