Microsoft Sql Server 2022 vulnerabilities
197 known vulnerabilities affecting microsoft/microsoft_sql_server_2022.
Total CVEs
197
CISA KEV
0
Public exploits
0
Exploited in wild
1
Severity breakdown
CRITICAL7HIGH156MEDIUM34
Vulnerabilities
Page 8 of 10
CVE-2026-67376P3HIGHCVSS 7.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67376 [HIGH] CWE-190 CVE-2026-67376: Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-68787P3HIGHCVSS 7.8≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-68787 [HIGH] CWE-122 CVE-2026-68787: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
nvd
CVE-2026-32167P3HIGHCVSS 7.8≥ 16.0.0, < 16.0.1175.12026-04-14
CVE-2026-32167 [HIGH] CWE-89 CVE-2026-32167: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85888P3HIGHCVSS 7.7≥ 16.0.0, < 16.0.1210.32026-10-13
CVE-2026-85888 [HIGH] CWE-125 CVE-2026-85888: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-88081P3HIGHCVSS 7.7≥ 16.0.0, < 16.0.1210.32026-10-13
CVE-2026-88081 [HIGH] CWE-125 CVE-2026-88081: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a networ
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-32176P3HIGHCVSS 7.8≥ 16.0.0, < 16.0.1175.12026-04-14
CVE-2026-32176 [HIGH] CWE-89 CVE-2026-32176: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-29045P3HIGHCVSS 7.5≥ 16.0.0, < 16.0.1115.12024-04-09
CVE-2024-29045 [HIGH] CWE-121 CVE-2024-29045: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-23384P3HIGHCVSS 7.3≥ 16.0.0, < 16.0.1050.52023-04-11
CVE-2023-23384 [HIGH] CWE-122 CVE-2023-23384: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-83945P3MEDIUMCVSS 6.6≥ 16.0.0, < 16.0.1210.32026-10-13
CVE-2026-83945 [MEDIUM] CWE-122 CVE-2026-83945: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a networ
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-67390P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67390 [MEDIUM] CWE-126 CVE-2026-67390: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-67386P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67386 [MEDIUM] CWE-908 CVE-2026-67386: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-68776P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-68776 [MEDIUM] CWE-908 CVE-2026-68776: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-73029P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-73029 [MEDIUM] CWE-126 CVE-2026-73029: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-67648P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67648 [MEDIUM] CWE-908 CVE-2026-67648: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-66816P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-66816 [MEDIUM] CWE-778 CVE-2026-66816: Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a
Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.
nvd
CVE-2026-67393P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67393 [MEDIUM] CWE-126 CVE-2026-67393: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2024-49021P3HIGHCVSS 7.8≥ 16.0.0, < 16.0.1135.22024-11-12
CVE-2024-49021 [HIGH] CWE-416 CVE-2024-49021: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-67641P3MEDIUMCVSS 6.5≥ 16.0.0.0, < 16.0.4275.2≥ 16.0.0, < 16.0.1200.52026-09-08
CVE-2026-67641 [MEDIUM] CWE-190 CVE-2026-67641: Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a ne
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
nvd
CVE-2023-21528P3HIGHCVSS 7.8≥ 16.0.0, < 16.0.1050.52023-02-14
CVE-2023-21528 [HIGH] CWE-122 CVE-2023-21528: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-85919P3HIGHCVSS 7.0≥ 16.0.0, < 16.0.1210.32026-10-13
CVE-2026-85919 [HIGH] CWE-122 CVE-2026-85919: Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
nvd