Known vulnerabilities in Microsoft SQL Server

Vendor: Microsoft
Software: Microsoft SQL Server
Software CPE: cpe:2.3:a:microsoft:microsoft_sql_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 180
Public exploits: 2
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft SQL Server Microsoft SQL Server is affected by 180 known vulnerabilities: 4 critical, 127 high, 38 medium, 11 low Critical High Medium Low

Vulnerabilities (180)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138259 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-47295		 CWE-89 Medium
No
No
 2016 SP3 13.0.7095.1, 2016 SP3 GDR 13.0.6500.1, 2017 GDR 14.0.2120.1, 2017 CU31 14.0.3540.1, 2019 GDR 15.0.2180.2, 2019 CU32 15.0.4480.2, 2022 GDR 16.0.1190.2, 2022 CU25 16.0.4262.2, 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071715
#VU138258 - External Control of File Name or Path
CVE-2026-55002		 CWE-73 Low
No
No
 2016 SP3 13.0.7095.1, 2016 SP3 GDR 13.0.6500.1, 2017 GDR 14.0.2120.1, 2017 CU31 14.0.3540.1, 2019 GDR 15.0.2180.2, 2019 CU32 15.0.4480.2, 2022 GDR 16.0.1190.2, 2022 CU25 16.0.4262.2, 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071715
#VU138257 - Deserialization of Untrusted Data
CVE-2026-54118		 CWE-502 Medium
No
No
 2016 SP3 13.0.7095.1, 2016 SP3 GDR 13.0.6500.1, 2017 GDR 14.0.2120.1, 2017 CU31 14.0.3540.1, 2019 GDR 15.0.2180.2, 2019 CU32 15.0.4480.2, 2022 GDR 16.0.1190.2, 2022 CU25 16.0.4262.2, 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071715
#VU138256 - Deserialization of Untrusted Data
CVE-2026-54117		 CWE-502 Medium
No
No
 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071715
#VU138255 - Out-of-bounds read
CVE-2026-50468		 CWE-125 Medium
No
No
 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071715
#VU138175 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-47296		 CWE-89 Low
No
No
 2016 SP3 13.0.7095.1, 2016 SP3 GDR 13.0.6500.1, 2017 GDR 14.0.2120.1, 2017 CU31 14.0.3540.1, 2019 GDR 15.0.2180.2, 2019 CU32 15.0.4480.2, 2022 GDR 16.0.1190.2, 2022 CU25 16.0.4262.2, 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071710
#VU138174 - Type confusion
CVE-2026-54116		 CWE-843 Medium
No
No
 2016 SP3 13.0.7095.1, 2016 SP3 GDR 13.0.6500.1, 2017 GDR 14.0.2120.1, 2017 CU31 14.0.3540.1, 2019 GDR 15.0.2180.2, 2019 CU32 15.0.4480.2, 2022 GDR 16.0.1190.2, 2022 CU25 16.0.4262.2, 2025 GDR 17.0.1125.2, 2025 CU6 + GDR 17.0.4060.2 17.07.2026 SB2026071710
#VU126246 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-32176		 CWE-89 Low
No
No
 13.0.6485.1, 13.0.7080.1, 14.0.2105.1, 14.0.3525.1, 15.0.2165.1, 15.0.4465.1, 16.0.1175.1, 16.0.4250.1, 17.0.1110.1, 17.0.4030.1 15.04.2026 SB20260415160
#VU126245 - Untrusted Pointer Dereference
CVE-2026-33120		 CWE-822 Medium
No
No
 16.0.1175.1 15.04.2026 SB20260415160
#VU126244 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-32167		 CWE-89 Low
No
No
 13.0.6485.1, 13.0.7080.1, 14.0.2105.1, 14.0.3525.1, 15.0.2165.1, 15.0.4465.1, 16.0.1175.1, 16.0.4250.1, 17.0.1110.1, 17.0.4030.1 15.04.2026 SB20260415160
#VU123767 - Improper Access Control
CVE-2026-21262		 CWE-284 Medium
No
No
 13.0.6480.4, 13.0.7075.5, 14.0.2100.4, 14.0.3520.4, 15.0.2160.4, 15.0.4460.4, 16.0.1170.5, 16.0.4240.4, 17.0.1105.2, 17.0.4020.2 10.03.2026 SB20260310116
#VU123766 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-26116		 CWE-89 Medium
No
No
 17.0.1105.2, 17.0.4020.2 10.03.2026 SB20260310116
#VU123758 - Improper Validation of Specified Type of Input
CVE-2026-26115		 CWE-1287 Low
No
No
 13.0.6480.4, 13.0.7075.5, 14.0.2100.4, 14.0.3520.4, 15.0.2160.4, 15.0.4460.4, 16.0.1170.5, 16.0.4240.4, 17.0.1105.2, 17.0.4020.2 10.03.2026 SB20260310116
#VU121347 - Missing Authentication for Critical Function
CVE-2026-20803		 CWE-306 Low
No
No
 - 13.01.2026 SB20260113135
#VU118288 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-59499		 CWE-89 Medium
No
No
 - 11.11.2025 SB2025111157
#VU115081 - Command injection
CVE-2025-55227		 CWE-77 Medium
No
No
 - 09.09.2025 SB2025090982
#VU115079 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-47997		 CWE-362 Medium
No
No
 - 09.09.2025 SB2025090982
SB2025110342
#VU113859 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-47954		 CWE-89 Medium
No
No
 - 12.08.2025 SB2025081271
#VU113858 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-49759		 CWE-89 Medium
No
No
 - 12.08.2025 SB2025081271
#VU113853 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-49758		 CWE-89 Medium
No
No
 - 12.08.2025 SB2025081271


Showing elements 1 - 20 out of 180