Microsoft SQL Server security vulnerabilities
Enterprise software. Public CVE monitoring for Microsoft SQL Server. Vendor security advisories are linked on this page.
Built for Operators of this product.
107 public records · 0 security-fix timeline events. 0 published in the last 7 days. 76 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 1
- High 14
- Medium 9
- Low 0
2026-08-0524 issues2026-11-02
Known exploited
View all known exploited- High8.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.Patch nowKEVEPSS 2.13%Mar 10, 2026
- High8.8Microsoft SQL Server Reporting Services Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.05%Feb 11, 2020
- High8.8Microsoft SQL Server Remote Code Execution VulnerabilityPatch nowKEVEPSS 57.27%Jul 15, 2019
- High8.8Microsoft SQL Server Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 6.69%Jan 12, 2021
Recently published
Browse catalog- High8.0Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.60%Oct 13, 2026
- Medium4.9Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.Check if you run itEPSS 0.84%Oct 13, 2026
- High8.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.65%Oct 13, 2026
- Medium6.7Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.Check if you run itEPSS 0.31%Oct 13, 2026
- High7.0Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.24%Oct 13, 2026
- Medium5.3Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.Check if you run itEPSS 0.36%Oct 13, 2026
- Medium6.4Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.25%Oct 13, 2026
- Medium5.3Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.Check if you run itEPSS 0.68%Oct 13, 2026
- High7.5Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.50%Oct 13, 2026
- High7.0Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.24%Oct 13, 2026