CVE-2026-67393

Microsoft SQL Server Information Disclosure Vulnerability

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (gdr) Microsoft Sql Server 2022 (gdr) and 5 more

CVE-2026-67368

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Sql Server 2017 Sql Server 2019 Sql Server 2022 and 1 more

CVE-2026-67390

Microsoft SQL Server Information Disclosure Vulnerability

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 9 more

CVE-2026-73028

SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 9 more

CVE-2026-77480

SQL Server Elevation of Privilege Vulnerability

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 8 more

CVE-2026-77482

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 3 more

CVE-2026-77483

SQL Server Elevation of Privilege Vulnerability

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 8 more

CVE-2026-77485

SQL Server Elevation of Privilege Vulnerability

Use after free in SQL Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2025 For X64-based Systems (gdr) Sql Server 2017 Sql Server 2019 and 2 more

CVE-2026-77486

Microsoft SQL Server Remote Code Execution Vulnerability

Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (gdr) Sql Server 2017 and 1 more

CVE-2026-77487

SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 8 more

CVE-2026-77488

Microsoft SQL Server Information Disclosure Vulnerability

Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 9 more

CVE-2026-77481

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2017 (cu 31) Microsoft Sql Server 2017 (gdr) Microsoft Sql Server 2019 (cu 32) and 9 more

CVE-2026-67638

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2025 (cu 2) Microsoft Sql Server 2025 For X64-based Systems (gdr) Sql Server 2025

CVE-2026-67641

Microsoft SQL Server Denial of Service Vulnerability

Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2022 (gdr) Microsoft Sql Server 2025 (cu 2) Microsoft Sql Server 2025 For X64-based Systems (gdr) and 2 more

CVE-2026-67642

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2025 (cu 2) Microsoft Sql Server 2025 For X64-based Systems (gdr) Sql Server 2025

CVE-2026-77484

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2019 (cu 32) Microsoft Sql Server 2019 (gdr) Microsoft Sql Server 2022 (gdr) and 5 more

CVE-2026-78456

SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2022 (gdr) Microsoft Sql Server 2025 (cu 2) Sql Server 2022

CVE-2026-73029

Microsoft SQL Server Information Disclosure Vulnerability

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Sql Server 2019 (gdr) Microsoft Sql Server 2022 (gdr) Microsoft Sql Server 2025 For X64-based Systems (gdr) and 3 more

CVE-2026-65669

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sql Server Management Studio

CVE-2026-67373

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sql Server 2025