Microsoft SQL Server Database Server

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Microsoft SQL Server.

Recent Microsoft SQL Server Security Advisories

Advisory	Title	Published
CVE-2026-103572	CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability	October 13, 2026
CVE-2026-65674	CVE-2026-65674 Microsoft SQL Server Remote Code Execution Vulnerability	October 13, 2026
CVE-2026-68883	CVE-2026-68883 Microsoft SQL Server Elevation of Privilege Vulnerability	October 13, 2026
CVE-2026-70189	CVE-2026-70189 Microsoft SQL Server Remote Code Execution Vulnerability	October 13, 2026
CVE-2026-85876	CVE-2026-85876 Microsoft SQL Server Elevation of Privilege Vulnerability	October 13, 2026
CVE-2026-85886	CVE-2026-85886 Microsoft SQL Server Remote Code Execution Vulnerability	October 13, 2026
CVE-2026-67626	CVE-2026-67626 Microsoft SQL Server Denial of Service Vulnerability	October 13, 2026
CVE-2026-67625	CVE-2026-67625 Microsoft SQL Server Remote Code Execution Vulnerability	October 13, 2026
CVE-2026-94520	CVE-2026-94520 Microsoft SQL Server Denial of Service Vulnerability	October 13, 2026
CVE-2026-83945	CVE-2026-83945 Microsoft SQL Server Remote Code Execution Vulnerability	October 13, 2026

By the Year

In 2026 there have been 0 vulnerabilities in Microsoft SQL Server. Last year, in 2025 SQL Server had 7 security vulnerabilities published. Right now, SQL Server is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	7	8.39
2024	57	8.65
2023	19	7.78
2022	2	8.15
2021	1	8.80
2020	1	9.80
2019	3	7.65
2018	4	0.00

It may take a day or so for new SQL Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft SQL Server Security Vulnerabilities

Aug 2025: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2025-24999 8.8 - High - August 12, 2025

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Authorization

Aug 2025: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2025-47954 8.8 - High - August 12, 2025

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

SQL Injection

Aug 2025: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2025-49759 8.8 - High - August 12, 2025

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

SQL Injection

Aug 2025: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2025-53727 8.8 - High - August 12, 2025

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

SQL Injection

Jul 2025: Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2025-49717 8.5 - High - July 08, 2025

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Heap-based Buffer Overflow

Jul 2025: Microsoft SQL Server Information Disclosure Vulnerability
CVE-2025-49718 7.5 - High - July 08, 2025

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

Use of Uninitialized Resource

Jul 2025: Microsoft SQL Server Information Disclosure Vulnerability
CVE-2025-49719 7.5 - High - July 08, 2025

Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

Improper Input Validation

MS SQL Server Native Client RCE via Remote Exploit
CVE-2024-48999 8.8 - High - November 12, 2024

SQL Server Native Client Remote Code Execution Vulnerability

Heap-based Buffer Overflow

Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2024-49021 7.8 - High - November 12, 2024

Microsoft SQL Server Remote Code Execution Vulnerability

Dangling pointer

Microsoft SQL Server XEvent Configuration Remote Code Execution Vulnerability
CVE-2024-49043 7.8 - High - November 12, 2024

Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability

Untrusted Path

Sep 2024: Microsoft SQL Server Information Disclosure Vulnerability
CVE-2024-43474 7.6 - High - September 10, 2024

Microsoft SQL Server Information Disclosure Vulnerability

Improper Null Termination

Sep 2024: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-26186 8.8 - High - September 10, 2024

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Dangling pointer

Sep 2024: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-37335 8.8 - High - September 10, 2024

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Heap-based Buffer Overflow

Sep 2024: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
CVE-2024-37337 7.1 - High - September 10, 2024

Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

Numeric Truncation Error

Sep 2024: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2024-37341 8.8 - High - September 10, 2024

Microsoft SQL Server Elevation of Privilege Vulnerability

Authorization

Sep 2024: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2024-37965 8.8 - High - September 10, 2024

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper Input Validation

Sep 2024: Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2024-37980 8.8 - High - September 10, 2024

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper Privilege Management

Sep 2024: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
CVE-2024-37966 7.1 - High - September 10, 2024

Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

Out-of-bounds Read

Sep 2024: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
CVE-2024-37342 7.1 - High - September 10, 2024

Microsoft SQL Server Native Scoring Information Disclosure Vulnerability

Out-of-bounds Read

Sep 2024: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-37340 8.8 - High - September 10, 2024

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Untrusted Pointer Dereference

Sep 2024: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-37339 8.8 - High - September 10, 2024

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Untrusted Pointer Dereference

Sep 2024: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVE-2024-26191 8.8 - High - September 10, 2024

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

Heap-based Buffer Overflow