CVE-2026-116936

Microsoft SQL Server Remote Code Execution Vulnerability

Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118103

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116941

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118108

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118110

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118111

Microsoft SQL Server Elevation of Privilege Vulnerability

Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118115

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) Sql Server 2017 and 3 more

CVE-2026-118116

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS 1.9% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118117

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-118118

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116939

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116940

Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116943

Microsoft SQL Server Information Disclosure Vulnerability

Buffer over-read in SQL Server allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116945

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-116947

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-67374

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-67632

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-67637

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-67391

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more

CVE-2026-94511

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more