Sql Server 2016 (Microsoft) - vulnerabilities (CVEs)

100 CVEs, 0 in the last 30 days, 105 known versions, newest CVE from 2026-07-14. Vendor: Microsoft.

CVEs of Sql Server 2016

• CVE-2026-47295 - CVSS 8.8 (high), 2026-07-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2026-55002 - CVSS 8.8 (high), 2026-07-14: External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-54118 - CVSS 9.8 (critical), 2026-07-14: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-54117 - CVSS 9.8 (critical), 2026-07-14: Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-47296 - CVSS 7.5 (high), 2026-07-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2026-40370 - CVSS 8.8 (high), 2026-05-12: External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-33120 - CVSS 8.8 (high), 2026-04-14: Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-32176 - CVSS 7.8 (high), 2026-04-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-32167 - CVSS 7.8 (high), 2026-04-14: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-26116 - CVSS 8.8 (high), 2026-03-10: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2026-26115 - CVSS 8.8 (high), 2026-03-10: Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-21262 - CVSS 8.8 (high), 2026-03-10: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-59499 - CVSS 8.8 (high), 2025-11-11: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2025-55227 - CVSS 8.8 (high), 2025-09-09: Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2025-47997 - CVSS 6.5 (medium), 2025-09-09: Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose…
• CVE-2025-53727 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2025-49758 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2025-49759 - CVSS 8.8 (high), 2025-08-12: Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2025-24999 - CVSS 8.8 (high), 2025-08-12: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-49719 - CVSS 7.5 (high), 2025-07-08: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2024-49043 - CVSS 7.8 (high), 2024-11-12: Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
• CVE-2024-49021 - CVSS 7.8 (high), 2024-11-12: Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2024-49016 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49018 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49017 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49013 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49012 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49015 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49011 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49014 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49007 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49010 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49009 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49008 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49003 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49006 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49002 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49005 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49004 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49000 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48999 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48998 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49001 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48994 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48997 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48996 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48995 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48993 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-43459 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-43462 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-38255 - CVSS 8.8 (high), 2024-11-12: SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-37980 - CVSS 9.8 (critical), 2024-09-10: Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-37965 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-37339 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37342 - CVSS 7.1 (high), 2024-09-10: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2024-37338 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37341 - CVSS 9.8 (critical), 2024-09-10: Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-37340 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37335 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37337 - CVSS 7.1 (high), 2024-09-10: Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2024-26191 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-26186 - CVSS 8.8 (high), 2024-09-10: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-38088 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-38087 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37333 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37332 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37331 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37336 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37329 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37328 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37327 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37330 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37322 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37326 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37321 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37324 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37323 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35271 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37319 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37318 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35272 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37320 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35256 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-28928 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21449 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21414 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21428 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21398 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21425 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21415 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21335 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21333 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21332 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21373 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21303 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21331 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21317 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21308 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-20701 - CVSS 8.8 (high), 2024-07-09: SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2019-1068 - CVSS 8.8 (high), 2019-07-15: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…