Microsoft SQL Server Vulnerabilities & Security Advisories

84 advisories tracked · Microsoft Security Update Guide (MSRC) · 2 listed in the CISA Known Exploited Vulnerabilities catalog

Every row below is a published Microsoft Server advisory that VulniPulse classified as SQL Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 6 critical, 62 high, 23 medium.

Source

Microsoft Security Update Guide (MSRC)

Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.

Visit Microsoft Server advisories MS Server RSS feed SQL Server end-of-life dates(36 dated releases)

Latest Microsoft SQL Server advisories

All severities critical (6)high (62)medium (23)low (0)

Critical9.8Vendor: HighMS Server

Critical [CVE-2026-116945] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High7.5MS Server

High [CVE-2026-116929] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2017; Microsoft SQL Server 2022.

High8.8MS Server

High [CVE-2026-116930] Microsoft SQL Server Remote Code Execution Vulnerability

High7.5MS Server

High [CVE-2026-116931] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

High7.2MS Server

High [CVE-2026-116933] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022.

High8.8MS Server

High [CVE-2026-116934] Microsoft SQL Server Elevation of Privilege Vulnerability

High7.2MS Server

High [CVE-2026-116936] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2022; Microsoft SQL Server 2025; Microsoft SQL Server 2019.

High7.5MS Server

High [CVE-2026-116943] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High7.2MS Server

High [CVE-2026-116944] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High8.8MS Server

High [CVE-2026-116946] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

High7.5MS Server

High [CVE-2026-118115] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

High7.0MS Server

High [CVE-2026-118116] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

High8.1MS Server

High [CVE-2026-66813] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-67372] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected product named by the advisory: Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-67374] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-67375] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected product named by the advisory: Microsoft SQL Server 2025.

High8.7MS Server

High [CVE-2026-70003] JDBC Driver for SQL Server Security Feature Bypass Vulnerability

JDBC Driver for SQL Server Security Feature Bypass Vulnerability Affected product named by the advisory: Microsoft JDBC Driver 13.4 for SQL Server.

High7.5MS Server

High [CVE-2026-84010] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High7.5MS Server

High [CVE-2026-88111] SQL Server Remote Code Execution Vulnerability

SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022.

High8.8MS Server

High [CVE-2026-94511] SQL Server Remote Code Execution Vulnerability

SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

High8.0MS Server

High [CVE-2026-94513] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025.

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-116932] Microsoft SQL Server Information Disclosure Vulnerability

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-116935] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2019; Microsoft SQL Server 2025; Microsoft SQL Server 2017.

Medium4.9Vendor: HighMS Server

Medium [CVE-2026-116940] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2025.

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-118104] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2017.

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-67382] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-68783] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected product named by the advisory: Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-94512] SQL Server Remote Code Execution Vulnerability

SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High7.0MS Server

High [CVE-2026-88088] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

High7.0MS Server

High [CVE-2026-85919] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025; Microsoft SQL Server 2019.

High7.7MS Server

High [CVE-2026-88081] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022.

High7.5MS Server

High [CVE-2026-88083] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-65674] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025; Microsoft SQL Server 2019.

High8.5MS Server

High [CVE-2026-85886] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022.

High7.0MS Server

High [CVE-2026-85876] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2025; Microsoft SQL Server 2022.

High8.5MS Server

High [CVE-2026-68883] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2025; Microsoft SQL Server 2019; Microsoft SQL Server 2022.

High8.0MS Server

High [CVE-2026-96956] SQL Server Elevation of Privilege Vulnerability

SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

Medium4.9Vendor: HighMS Server

Medium [CVE-2026-94520] Microsoft SQL Server Denial of Service Vulnerability

Microsoft SQL Server Denial of Service Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2022; Microsoft SQL Server 2019; Microsoft SQL Server 2025.

Medium6.7Vendor: HighMS Server

Medium [CVE-2026-88089] Microsoft SQL Server Remote Code Execution Vulnerability

Medium6.4Vendor: HighMS Server

Medium [CVE-2026-88085] Microsoft SQL Server Elevation of Privilege Vulnerability

Medium5.3Vendor: HighMS Server

Medium [CVE-2026-88086] Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server Information Disclosure Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

Medium5.3Vendor: HighMS Server

Medium [CVE-2026-88084] Microsoft SQL Server Denial of Service Vulnerability

Microsoft SQL Server Denial of Service Vulnerability Affected product named by the advisory: Microsoft SQL Server 2019.

Medium6.5Vendor: HighMS Server

Medium [CVE-2026-67626] Microsoft SQL Server Denial of Service Vulnerability

Microsoft SQL Server Denial of Service Vulnerability Affected products named by the advisory: Microsoft SQL Server 2022; Microsoft SQL Server 2025.

Critical9.6MS Server

Critical [CVE-2026-65669] Microsoft SQL Server Elevation of Privilege Vulnerability

Microsoft SQL Server Elevation of Privilege Vulnerability Affected product named by the advisory: SQL Server Management Studio 22.

Critical9.0MS Server

Critical [CVE-2026-67636] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

High8.8MS Server

High [CVE-2026-78456] SQL Server Remote Code Execution Vulnerability

SQL Server Remote Code Execution Vulnerability Affected product named by the advisory: Microsoft SQL Server 2022.

High8.8MS Server

High [CVE-2026-78442] Windows OLE DB Remote Code Execution Vulnerability

Windows OLE DB Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High8.8MS Server

High [CVE-2026-77486] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High8.8MS Server

High [CVE-2026-73028] SQL Server Elevation of Privilege Vulnerability

SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2022; Microsoft SQL Server 2017; Microsoft SQL Server 2019.

High8.8MS Server

High [CVE-2026-67388] Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft SQL Server 2025; Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022.

Page 1 of 2 · showing 50 of 84

Get an email when Microsoft SQL Server publishes the next one.

See Microsoft SQL Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Microsoft SQL Server

iPhone and Android apps · New on the App Store

Monitor Microsoft SQL Server CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts on Android See app features

← All MS Server advisories