Skip to content
VulniPulse
Sign in
High7.8Microsoft Server

High [CVE-2023-21528] Microsoft SQL Server Remote Code Execution Vulnerability

This high-severity Microsoft Server advisory covers CVE-2023-21528 affecting Microsoft SQL Server 2008 R2 Service Pack 3 (QFE), Microsoft SQL Server 2008 Service Pack 4 (QFE), Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE).

CVE-2023-21528 Published Feb 14, 2023Updated by vendor Aug 19, 2026
CVE-2023-21528
Affected products & platforms
Microsoft ServerSQL Server
Open vendor advisory

Android app · Google Play

Monitor future Microsoft Server CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Microsoft SQL Server Remote Code Execution Vulnerability

Affected products named by the advisory: Microsoft SQL Server 2008 R2 Service Pack 3 (QFE); Microsoft SQL Server 2008 Service Pack 4 (QFE); Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE); Microsoft SQL Server 2012 Service Pack 4 (QFE); and 9 more.

Affected products named by the advisory: Microsoft SQL Server 2014 Service Pack 3 (CU 4); Microsoft SQL Server 2014 Service Pack 3 (GDR); Microsoft SQL Server 2016 Service Pack 3 (GDR); Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack; and 5 more.

Affected products named by the advisory: Microsoft SQL Server 2017 (CU 31); Microsoft SQL Server 2017 (GDR); Microsoft SQL Server 2019 (CU 18); Microsoft SQL Server 2019 (GDR); and 1 more.

Affected versions
  • Microsoft SQL Server 2008 R2 Service Pack 3 (QFE) 10.0.0 before 10.50.6785.2
  • Microsoft SQL Server 2008 Service Pack 4 (QFE) 10.0.0 before 10.0.6814.4
  • Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE) 11.0.0 before 11.0.7512.11
  • Microsoft SQL Server 2012 Service Pack 4 (QFE) 11.0.0 before 11.0.7512.11
  • Microsoft SQL Server 2014 Service Pack 3 (CU 4) 12.0.0 before 12.0.6174.8
  • Microsoft SQL Server 2014 Service Pack 3 (GDR) 12.0.0 before 12.0.6444.4
  • Microsoft SQL Server 2016 Service Pack 3 (GDR) 13.0.0 before 13.0.6430.49
  • Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack 13.0.0 before 13.0.7024.30
  • Microsoft SQL Server 2017 (CU 31) 14.0.0 before 14.0.3460.9
  • Microsoft SQL Server 2017 (GDR) 14.0.0 before 14.0.2047.8
  • Microsoft SQL Server 2019 (CU 18) 15.0.0 before 15.0.4280.7
  • Microsoft SQL Server 2019 (GDR) 15.0.0 before 15.0.2101.7

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions
  • 10.50.6785.2
  • 10.0.6814.4
  • 11.0.7512.11
  • 12.0.6174.8
  • 12.0.6444.4
  • 13.0.6430.49
  • 13.0.7024.30
  • 14.0.3460.9
  • 14.0.2047.8
  • 15.0.4280.7
  • 15.0.2101.7
  • 16.0.1050.5

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 10.50.6785.2, 10.0.6814.4, 11.0.7512.11, 12.0.6174.8, 12.0.6444.4, 13.0.6430.49. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.