Product · Microsoft

Microsoft SQL Server 2025 for x64-based Systems (GDR)

142 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

90 results · Clear filters · Feed

High 8.8

CVE-2026-67370

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Sep 8, 2026
High 8.8

CVE-2026-67368

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Sep 8, 2026
High 8.8

CVE-2026-47295

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Jul 14, 2026
High 8.8

CVE-2026-55002

Microsoft SQL Server Elevation of Privilege Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Jul 14, 2026
High 7.5

CVE-2026-47296

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Jul 14, 2026
High 8.8

CVE-2026-40370

SQL Server Remote Code Execution Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

May 12, 2026
High 8.8

CVE-2026-26115

SQL Server Elevation of Privilege Vulnerability

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Mar 10, 2026
High 8.8

CVE-2026-26116

SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2025 for x64-based Systems (GDR) Microsoft SQL Server 2025 (CU 2)

Mar 10, 2026
High 8.8

CVE-2026-21262

SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Mar 10, 2026
High 7.2

CVE-2026-20803

Microsoft SQL Server Elevation of Privilege Vulnerability

Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2025 for x64-based Systems (GDR) Microsoft SQL Server 2022 for x64-based Systems (CU 22)

Jan 13, 2026