Microsoft Sql Server 2019 vulnerabilities
224 known vulnerabilities affecting microsoft/microsoft_sql_server_2019.
Total CVEs
224
CISA KEV
0
Public exploits
0
Exploited in wild
2
Severity breakdown
CRITICAL6HIGH186MEDIUM32
Vulnerabilities
Page 3 of 12
CVE-2024-37340P2HIGHCVSS 8.8≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-37340 [HIGH] CWE-822 CVE-2024-37340: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-37338P2HIGHCVSS 8.8≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-37338 [HIGH] CWE-125 CVE-2024-37338: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-26186P3HIGHCVSS 8.8≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-26186 [HIGH] CWE-416 CVE-2024-26186: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2025-49758P3HIGHCVSS 8.8≥ 15.0.0.0, < 15.0.4440.1≥ 15.0.0, < 15.0.2140.12025-08-12
CVE-2025-49758 [HIGH] CWE-269 CVE-2025-49758: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-67384P3HIGHCVSS 8.8≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-67384 [HIGH] CWE-122 CVE-2026-67384: Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a ne
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2024-37341P3CRITICALCVSS 9.8≥ 15.0.0, < 15.0.4395.2≥ 15.0.0, < 15.0.2125.12024-09-10
CVE-2024-37341 [CRITICAL] CWE-284 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2024-37980P3CRITICALCVSS 9.8≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-37980 [CRITICAL] CWE-269 CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2024-37965P2HIGHCVSS 8.8≥ 15.0.0, < 15.0.4390.2≥ 15.0.0, < 15.0.2120.12024-09-10
CVE-2024-37965 [HIGH] CWE-20 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2026-67636P3CRITICALCVSS 9.0≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-67636 [CRITICAL] CWE-125 CVE-2026-67636: Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49719P3HIGHCVSS 7.5≥ 15.0.0.0, < 15.0.4435.7≥ 15.0.0, < 15.0.2135.52025-07-08
CVE-2025-49719 [HIGH] CWE-20 CVE-2025-49719: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-67625P3HIGHCVSS 8.5≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-67625 [HIGH] CWE-122 CVE-2026-67625: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2023-21713P3HIGHCVSS 8.8≥ 15.0.0, < 15.0.4280.7≥ 15.0.0, < 15.0.2101.72023-02-14
CVE-2023-21713 [HIGH] CWE-502 CVE-2023-21713: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-78442P3HIGHCVSS 8.8≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-78442 [HIGH] CWE-122 CVE-2026-78442: Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-85886P3HIGHCVSS 8.5≥ 15.0.0, < 15.0.2200.22026-10-13
CVE-2026-85886 [HIGH] CWE-122 CVE-2026-85886: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-47297P3HIGHCVSS 8.1≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-47297 [HIGH] CWE-502 CVE-2026-47297: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-77482P3HIGHCVSS 8.8≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-77482 [HIGH] CWE-122 CVE-2026-77482: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a netw
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-77486P3HIGHCVSS 8.8≥ 15.0.0.0, < 15.0.4490.9≥ 15.0.0, < 15.0.2190.72026-09-08
CVE-2026-77486 [HIGH] CWE-122 CVE-2026-77486: Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-49717P3HIGHCVSS 8.5≥ 15.0.0.0, < 15.0.4435.7≥ 15.0.0, < 15.0.2135.52025-07-08
CVE-2025-49717 [HIGH] CWE-122 CVE-2025-49717: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-47296P3HIGHCVSS 7.5≥ 15.0.0.0, < 15.0.4480.2≥ 15.0.0, < 15.0.2180.22026-07-14
CVE-2026-47296 [HIGH] CWE-89 CVE-2026-47296: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2024-37332P3HIGHCVSS 8.8≥ 15.0.0, < 15.0.2116.22024-07-09
CVE-2024-37332 [HIGH] CWE-122 CVE-2024-37332: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd