cbcvebase.

Microsoft Sql Server 2016 vulnerabilities

99 known vulnerabilities affecting microsoft/sql_server_2016.

Total CVEs
99
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
2
Severity breakdown
CRITICAL4HIGH92MEDIUM3

Vulnerabilities

Page 1 of 5
CVE-2019-1068P1HIGHCVSS 8.8KEVPoCRansomware≥ 13.0.4001.0, < 13.0.4259.0≥ 13.0.4411.0, < 13.0.4604.0+2 more2019-07-15
CVE-2019-1068 [HIGH] CWE-20 CVE-2019-1068: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles pro A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
nvd
CVE-2026-21262P1HIGHCVSS 8.8Exploited≥ 13.0.6300.2, < 13.0.6480.4≥ 13.0.7000.253, < 13.0.7075.52026-03-10
CVE-2026-21262 [HIGH] CWE-284 CVE-2026-21262: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a net Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-54118P2CRITICALCVSS 9.8≥ 13.0.6300.2, < 13.0.6500.1≥ 13.0.7000.253, < 13.0.7095.12026-07-14
CVE-2026-54118 [CRITICAL] CWE-502 CVE-2026-54118: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-54117P2CRITICALCVSS 9.8≥ 13.0.6300.2, < 13.0.6500.1≥ 13.0.7000.253, < 13.0.7095.12026-07-14
CVE-2026-54117 [CRITICAL] CWE-502 CVE-2026-54117: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-24999P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6465.1≥ 13.0.7000.253, < 13.0.7060.12025-08-12
CVE-2025-24999 [HIGH] CWE-284 CVE-2025-24999: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a net Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-47295P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6500.1≥ 13.0.7000.253, < 13.0.7095.12026-07-14
CVE-2026-47295 [HIGH] CWE-89 CVE-2026-47295: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-26116P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6480.4≥ 13.0.7000.253, < 13.0.7075.52026-03-10
CVE-2026-26116 [HIGH] CWE-89 CVE-2026-26116: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-26115P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6480.4≥ 13.0.7000.253, < 13.0.7075.52026-03-10
CVE-2026-26115 [HIGH] CWE-1287 CVE-2026-26115: Improper validation of specified type of input in SQL Server allows an authorized attacker to elevat Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2025-55227P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6470.1≥ 13.0.7000.253, < 13.0.7065.12025-09-09
CVE-2025-55227 [HIGH] CWE-77 CVE-2025-55227: Improper neutralization of special elements used in a command ('command injection') in SQL Server al Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-33120P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6485.1≥ 13.0.7000.253, < 13.0.7080.12026-04-14
CVE-2026-33120 [HIGH] CWE-822 CVE-2026-33120: Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a net Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2025-59499P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6475.1≥ 13.0.7000.253, < 13.0.7070.12025-11-11
CVE-2025-59499 [HIGH] CWE-89 CVE-2025-59499: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-55002P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6500.1≥ 13.0.7000.253, < 13.0.7095.12026-07-14
CVE-2026-55002 [HIGH] CWE-73 CVE-2026-55002: External control of file name or path in SQL Server allows an authorized attacker to elevate privile External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2025-49759P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6465.1≥ 13.0.7000.253, < 13.0.7060.12025-08-12
CVE-2025-49759 [HIGH] CWE-89 CVE-2025-49759: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2025-53727P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6465.1≥ 13.0.7000.253, < 13.0.7060.12025-08-12
CVE-2025-53727 [HIGH] CWE-89 CVE-2025-53727: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2024-26191P3HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-26191 [HIGH] CWE-122 CVE-2024-26191: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-37335P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-37335 [HIGH] CWE-122 CVE-2024-37335: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-37339P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-37339 [HIGH] CWE-822 CVE-2024-37339: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-37340P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-37340 [HIGH] CWE-822 CVE-2024-37340: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-37338P2HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-37338 [HIGH] CWE-125 CVE-2024-37338: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
CVE-2024-26186P3HIGHCVSS 8.8≥ 13.0.6300.2, < 13.0.6441.12024-09-10
CVE-2024-26186 [HIGH] CWE-416 CVE-2024-26186: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
nvd
1 / 5Next →
Microsoft Sql Server 2016 vulnerabilities | cvebase