Sql Server 2025

sql_server_2025

Vendor: Microsoft • 14 CVEs

CVEs (14)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-54116 1Microsoft 1Sql Server 2025 Jul 22, 2026 Jul 14, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-50468 1Microsoft 1Sql Server 2025 Jul 22, 2026 Jul 14, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
CVE-2026-47295 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 22, 2026 Jul 14, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-54118 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 22, 2026 Jul 14, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-54117 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 22, 2026 Jul 14, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-47296 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 16, 2026 Jul 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-40370 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jun 18, 2026 May 12, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-33120 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 24, 2026 Apr 14, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
CVE-2026-32176 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jun 17, 2026 Apr 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-32167 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jun 17, 2026 Apr 14, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-26116 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-26115 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jun 17, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-21262 1Microsoft 5Sql Server 2016 Sql Server 2017Sql Server 2019+2 more Jul 10, 2026 Mar 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-20803 1Microsoft 2Sql Server 2022 Sql Server 2025 Jun 17, 2026 Jan 13, 2026 N/A· v4 7.2 HIGH· v3 N/A· v2 Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.