Microsoft Sql Server 2022 vulnerabilities

CVE-2026-33120 [HIGH] CWE-822 CVE-2026-33120: Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a net Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

CVE-2026-32176 [MEDIUM] CWE-89 CVE-2026-32176: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

CVE-2026-32167 [MEDIUM] CWE-89 CVE-2026-32167: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

CVE-2026-21262 [HIGH] CWE-284 CVE-2026-21262: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a net Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-26115 [HIGH] CWE-1287 CVE-2026-26115: Improper validation of specified type of input in SQL Server allows an authorized attacker to elevat Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-20803 [HIGH] CWE-306 CVE-2026-20803: Missing authentication for critical function in SQL Server allows an authorized attacker to elevate Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-59499 [HIGH] CWE-89 CVE-2025-59499: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-55227 [HIGH] CWE-77 CVE-2025-55227: Improper neutralization of special elements used in a command ('command injection') in SQL Server al Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-47997 [MEDIUM] CWE-200 CVE-2025-47997: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL S Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

CVE-2025-49759 [HIGH] CWE-89 CVE-2025-49759: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-24999 [HIGH] CWE-284 CVE-2025-24999: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a net Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-47954 [HIGH] CWE-89 CVE-2025-47954: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-49758 [HIGH] CWE-269 CVE-2025-49758: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-53727 [HIGH] CWE-89 CVE-2025-53727: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-49719 [HIGH] CWE-20 CVE-2025-49719: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

CVE-2025-49717 [HIGH] CWE-122 CVE-2025-49717: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVE-2025-49718 [HIGH] CWE-908 CVE-2025-49718: Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

CVE-2024-49021 [HIGH] CWE-416 CVE-2024-49021: Microsoft SQL Server Remote Code Execution Vulnerability Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2024-49043 [HIGH] CWE-426 CVE-2024-49043: Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability

CVE-2024-37341 [CRITICAL] CWE-284 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability Microsoft SQL Server Elevation of Privilege Vulnerability