This vulnerability (CVE-2026-40370) in Microsoft SQL Server 2016 Service Pack 3 (GDR) is classified under CWE-73 (External Control of File Name or Path). It enables an authorized attacker to execute arbitrary code remotely by controlling file names or paths used by the server. The CVSS 3.1 base score is 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected SQL Server instance, potentially leading to full compromise of the server. Confidentiality, integrity, and availability impacts are all rated high.

An official fix is available from Microsoft. Users should apply the security update provided for Microsoft SQL Server 2016 Service Pack 3 (GDR) as detailed in the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370. No additional mitigations are indicated by the vendor advisory.