Microsoft Sql Server 2017 vulnerabilities
147 known vulnerabilities affecting microsoft/sql_server_2017.
Total CVEs
147
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
2
Severity breakdown
CRITICAL5HIGH120MEDIUM22
Vulnerabilities
Page 3 of 8
CVE-2025-49758P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2080.1≥ 14.0.3006.16, < 14.0.3500.12025-08-12
CVE-2025-49758 [HIGH] CWE-269 CVE-2025-49758: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-67384P3HIGHCVSS 8.8fixed in 14.0.2130.4≥ 14.0.3006.16, < 14.0.3550.42026-09-08
CVE-2026-67384 [HIGH] CWE-122 CVE-2026-67384: Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a ne
Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
nvd
CVE-2024-37341P3CRITICALCVSS 9.8≥ 14.0.1000.169, < 14.0.2060.1≥ 14.0.3006.16, < 14.0.3475.12024-09-10
CVE-2024-37341 [CRITICAL] CWE-284 CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2024-37980P3CRITICALCVSS 9.8≥ 14.0.1000.169, < 14.0.2060.1≥ 14.0.3006.16, < 14.0.3475.12024-09-10
CVE-2024-37980 [CRITICAL] CWE-269 CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2024-37965P2HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2060.1≥ 14.0.3006.16, < 14.0.3475.12024-09-10
CVE-2024-37965 [HIGH] CWE-20 CVE-2024-37965: Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
nvd
CVE-2025-49719P3HIGHCVSS 7.5≥ 14.0.1000.169, < 14.0.2075.8≥ 14.0.3006.16, < 14.0.3495.92025-07-08
CVE-2025-49719 [HIGH] CWE-20 CVE-2025-49719: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-78442P3HIGHCVSS 8.8fixed in 14.0.2130.4≥ 14.0.3006.16, < 14.0.3550.42026-09-08
CVE-2026-78442 [HIGH] CWE-122 CVE-2026-78442: Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a
Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-77482P3HIGHCVSS 8.8fixed in 14.0.2130.4≥ 14.0.3006.16, < 14.0.3550.42026-09-08
CVE-2026-77482 [HIGH] CWE-122 CVE-2026-77482: Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a netw
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-77486P3HIGHCVSS 8.8fixed in 14.0.2130.4≥ 14.0.3006.16, < 14.0.3550.42026-09-08
CVE-2026-77486 [HIGH] CWE-122 CVE-2026-77486: Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-47296P3HIGHCVSS 7.5≥ 14.0.1000.169, < 14.0.2120.1≥ 14.0.3006.16, < 14.0.3540.12026-07-14
CVE-2026-47296 [HIGH] CWE-89 CVE-2026-47296: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2024-37332P3HIGHCVSS 8.8fixed in 14.0.2056.2≥ 14.0.3456.2, < 14.0.3471.22024-07-09
CVE-2024-37332 [HIGH] CWE-122 CVE-2024-37332: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-21414P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2056.2≥ 14.0.3006.16, < 14.0.3471.22024-07-09
CVE-2024-21414 [HIGH] CWE-122 CVE-2024-21414: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-37318P3HIGHCVSS 8.8fixed in 14.0.2056.2≥ 14.0.3456.2, < 14.0.3471.22024-07-09
CVE-2024-37318 [HIGH] CWE-122 CVE-2024-37318: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-35272P3HIGHCVSS 8.8fixed in 14.0.2056.2≥ 14.0.3456.2, < 14.0.3471.22024-07-09
CVE-2024-35272 [HIGH] CWE-122 CVE-2024-35272: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-21398P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2056.2≥ 14.0.3006.16, < 14.0.3471.22024-07-09
CVE-2024-21398 [HIGH] CWE-122 CVE-2024-21398: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-37331P3HIGHCVSS 8.8fixed in 14.0.2056.2≥ 14.0.3456.2, < 14.0.3471.22024-07-09
CVE-2024-37331 [HIGH] CWE-122 CVE-2024-37331: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-35271P3HIGHCVSS 8.8fixed in 14.0.2056.2≥ 14.0.3456.2, < 14.0.3471.22024-07-09
CVE-2024-35271 [HIGH] CWE-122 CVE-2024-35271: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-21333P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2056.2≥ 14.0.3006.16, < 14.0.3471.22024-07-09
CVE-2024-21333 [HIGH] CWE-122 CVE-2024-21333: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-21415P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2056.2≥ 14.0.3006.16, < 14.0.3471.22024-07-09
CVE-2024-21415 [HIGH] CWE-122 CVE-2024-21415: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2024-21428P3HIGHCVSS 8.8≥ 14.0.1000.169, < 14.0.2056.2≥ 14.0.3006.16, < 14.0.3471.22024-07-09
CVE-2024-21428 [HIGH] CWE-190 CVE-2024-21428: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd