Microsoft Sql Server 2017 — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Sql Server 2017, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (147)

• CVE-2026-54118 — CVSS 9.8 (critical): Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-67631 — CVSS 9.8 (critical): Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-54117 — CVSS 9.8 (critical): Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2024-21308 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21317 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21331 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21332 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21333 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21335 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21373 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21398 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21414 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21415 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21425 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21428 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21449 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-26186 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-26191 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-28928 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35256 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35271 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35272 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37318 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37319 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37320 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37321 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37322 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37323 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37324 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37326 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37327 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37328 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37329 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37330 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37331 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37332 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37333 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37335 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37336 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37338 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37339 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37340 — CVSS 8.8 (high): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
• CVE-2024-37341 — CVSS 8.8 (high): Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-37965 — CVSS 8.8 (high): Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-37980 — CVSS 8.8 (high): Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2024-38087 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-38088 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-38255 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-43459 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-43462 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2026-67381 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2024-20701 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21303 — CVSS 8.8 (high): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2025-49759 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2025-53727 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2025-55227 — CVSS 8.8 (high): Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2025-59499 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-21262 — CVSS 8.8 (high): Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-26115 — CVSS 8.8 (high): Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-26116 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-33120 — CVSS 8.8 (high): Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-40370 — CVSS 8.8 (high): External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-47295 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-55002 — CVSS 8.8 (high): External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-66814 — CVSS 8.8 (high): Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-66818 — CVSS 8.8 (high): Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-66819 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-66820 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-67368 — CVSS 8.8 (high): Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a…
• CVE-2026-67370 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-67380 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2019-1068 — CVSS 8.8 (high) — actively exploited: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka…
• CVE-2026-67384 — CVSS 8.8 (high): Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-67385 — CVSS 8.8 (high): Use after free in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-67388 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-67639 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-68775 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-68786 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-73028 — CVSS 8.8 (high): Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77480 — CVSS 8.8 (high): Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77481 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77482 — CVSS 8.8 (high): Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-77483 — CVSS 8.8 (high): Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77486 — CVSS 8.8 (high): Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-77487 — CVSS 8.8 (high): Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-78442 — CVSS 8.8 (high): Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
• CVE-2024-48993 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48994 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48995 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48996 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48997 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48998 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-48999 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49000 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49001 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49002 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49003 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49004 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49005 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49006 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49007 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49008 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49009 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49010 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49011 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49012 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49013 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49014 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49015 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49016 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49017 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2024-49018 — CVSS 8.8 (high): SQL Server Native Client Remote Code Execution Vulnerability
• CVE-2025-24999 — CVSS 8.8 (high): Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-49758 — CVSS 8.8 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-68787 — CVSS 7.8 (high): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
• CVE-2024-49043 — CVSS 7.8 (high): Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
• CVE-2024-49021 — CVSS 7.8 (high): Microsoft SQL Server Remote Code Execution Vulnerability
• CVE-2024-43474 — CVSS 7.6 (high): Microsoft SQL Server Information Disclosure Vulnerability
• CVE-2026-47296 — CVSS 7.5 (high): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-67376 — CVSS 7.5 (high): Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
• CVE-2025-49719 — CVSS 7.5 (high): Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2024-37337 — CVSS 7.1 (high): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2024-37966 — CVSS 7.1 (high): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2024-37342 — CVSS 7.1 (high): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2026-77485 — CVSS 7.0 (high): Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-32176 — CVSS 6.7 (medium): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-32167 — CVSS 6.7 (medium): Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate…
• CVE-2026-68779 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-68780 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-68781 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-68784 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2025-47997 — CVSS 6.5 (medium): Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to…
• CVE-2026-67386 — CVSS 6.5 (medium): Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-69562 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2026-67390 — CVSS 6.5 (medium): Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-67393 — CVSS 6.5 (medium): Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-67629 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-67630 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-67633 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
• CVE-2026-67645 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-67648 — CVSS 6.5 (medium): Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-78441 — CVSS 6.5 (medium): Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.
• CVE-2026-68776 — CVSS 6.5 (medium): Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-68777 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-68778 — CVSS 6.5 (medium): Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-77488 — CVSS 5.5 (medium): Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
• CVE-2026-68785 — CVSS 4.9 (medium): Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.