Microsoft Sql Server 2022 vulnerabilities
166 known vulnerabilities affecting microsoft/sql_server_2022.
Total CVEs
166
CISA KEV
0
Public exploits
0
Exploited in wild
1
Severity breakdown
CRITICAL8HIGH133MEDIUM25
Vulnerabilities
Page 7 of 9
CVE-2024-28938P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28938 [HIGH] CWE-125 CVE-2024-28938: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28913P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28913 [HIGH] CWE-122 CVE-2024-28913: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28926P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28926 [HIGH] CWE-122 CVE-2024-28926: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28912P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28912 [HIGH] CWE-122 CVE-2024-28912: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28939P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28939 [HIGH] CWE-209 CVE-2024-28939: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28945P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28945 [HIGH] CWE-191 CVE-2024-28945: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28941P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28941 [HIGH] CWE-122 CVE-2024-28941: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28911P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28911 [HIGH] CWE-122 CVE-2024-28911: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-28915P3HIGHCVSS 8.8≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-28915 [HIGH] CWE-122 CVE-2024-28915: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-37334P3HIGHCVSS 8.8fixed in 16.0.1121.4≥ 16.0.4125.3, < 16.0.4131.22024-07-09
CVE-2024-37334 [HIGH] CWE-122 CVE-2024-37334: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-21303P3HIGHCVSS 8.8≥ 16.0.0.0, < 16.0.1121.4≥ 16.0.1121.5, < 16.0.4131.22024-07-09
CVE-2024-21303 [HIGH] CWE-416 CVE-2024-21303: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
nvd
CVE-2025-49718P3HIGHCVSS 7.5≥ 16.0.1000.6, < 16.0.1140.6≥ 16.0.4003.1, < 16.0.4200.12025-07-08
CVE-2025-49718 [HIGH] CWE-908 CVE-2025-49718: Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-67376P3HIGHCVSS 7.5fixed in 16.0.1200.5≥ 16.0.4003.1, < 16.0.4275.22026-09-08
CVE-2026-67376 [HIGH] CWE-190 CVE-2026-67376: Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-68787P3HIGHCVSS 7.8fixed in 16.0.1200.5≥ 16.0.4003.1, < 16.0.4275.22026-09-08
CVE-2026-68787 [HIGH] CWE-122 CVE-2026-68787: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
nvd
CVE-2026-32167P3HIGHCVSS 7.8≥ 16.0.1000.6, < 16.0.1175.1≥ 16.0.4003.1, < 16.0.4250.12026-04-14
CVE-2026-32167 [HIGH] CWE-89 CVE-2026-32167: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-32176P3HIGHCVSS 7.8≥ 16.0.1000.6, < 16.0.1175.1≥ 16.0.4003.1, < 16.0.4250.12026-04-14
CVE-2026-32176 [HIGH] CWE-89 CVE-2026-32176: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-29045P3HIGHCVSS 7.5≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.12024-04-09
CVE-2024-29045 [HIGH] CWE-121 CVE-2024-29045: Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2026-67390P3MEDIUMCVSS 6.5fixed in 16.0.1200.5≥ 16.0.4003.1, < 16.0.4275.22026-09-08
CVE-2026-67390 [MEDIUM] CWE-126 CVE-2026-67390: Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-67386P3MEDIUMCVSS 6.5fixed in 16.0.1200.5≥ 16.0.4003.1, < 16.0.4275.22026-09-08
CVE-2026-67386 [MEDIUM] CWE-908 CVE-2026-67386: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-68776P3MEDIUMCVSS 6.5fixed in 16.0.1200.5≥ 16.0.4003.1, < 16.0.4275.22026-09-08
CVE-2026-68776 [MEDIUM] CWE-908 CVE-2026-68776: Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information ov
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
nvd