CVE-2026-66814

Microsoft SQL Server is affected by an insufficient granularity of access control flaw that allows an authorized attacker to elevate privileges over a network. The vulnerability is rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege network ac...

CVE-2026-66819

CVE-2026-66819 is an SQL injection vulnerability in Microsoft SQL Server , caused by improper neutralization of special elements used in SQL commands. An authorized attacker can exploit it over a network to elevate privileges , with a CVSS 3.1 score of 8.8 (HIGH) and impacts rated High for confid...

CVE-2026-77485

CVE-2026-77485 is a use-after-free vulnerability in Microsoft SQL Server that allows an authorized attacker to elevate privileges locally . The flaw requires local access and low privileges, with high attack complexity and no user interaction, scoring CVSS 3.1 7.0 (HIGH) with full impact on confi...

CVE-2026-68779

CVE-2026-68779 is an out-of-bounds read in Microsoft SQL Server that allows an authorized (low-privilege) attacker to disclose information over a network. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , indicating a high confidentiality impact with no int...

CVE-2026-67388

CVE-2026-67388 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over the network. The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack ...

CVE-2026-77487

CVE-2026-77487 is an improper access control vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to elevate privileges over a network with low complexity and no user interaction. The CVSS 3.1 base score is 8.8 (HIGH) , with high impact to confidentia...

CVE-2026-68778

CVE-2026-68778 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network . The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidential...

CVE-2026-77482

CVE-2026-77482 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity but required user interac...

CVE-2026-66818

Microsoft SQL Server is affected by an improper privilege management flaw that allows an authorized attacker to escalate privileges over a network . The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low privileges and no user interaction ...

CVE-2026-67381

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) , with an attack vector of network, low complexity, low privileges required, and no user interaction needed, resulting in high impact to confi...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...

CVE-2026-77486

CVE-2026-77486 is a remote code execution vulnerability in Microsoft SQL Server caused by an integer overflow or wraparound , allowing an unauthorized attacker to execute code over a network. The vulnerability requires user interaction (UI:R) but demands no prior privileges (PR:N) and has low att...

CVE-2026-67385

Microsoft SQL Server is affected by a use-after-free vulnerability that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment indicates no known exploit...

CVE-2026-67386

Microsoft SQL Server is affected by a use of uninitialized resource flaw that allows an authorized attacker (low privileges) to disclose information over a network. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high con...

CVE-2026-67393

CVE-2026-67393 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The vulnerability is classified as information disclosure with a CVSS 3.1 base score of 6.5 (Medium) , requiring low privileges and no user interac...

CVE-2026-67370

CVE-2026-67370 is an SQL injection vulnerability in Microsoft SQL Server where improper neutralization of special elements used in a SQL command allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L...

CVE-2026-67384

Microsoft SQL Server is affected by an integer overflow or wraparound vulnerability that allows an authorized attacker to execute code over a network, leading to a remote code execution scenario. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, and low privileges req...

CVE-2026-66820

CVE-2026-66820 is an SQL injection vulnerability in SQL Server caused by improper neutralization of special elements in a SQL command. An authorized attacker with low privileges can exploit it over the network without user interaction to elevate privileges , resulting in high impact to confidenti...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating no privileges or user in...

CVE-2026-67639

CVE-2026-67639 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (HIGH) with full impact to confidentiality, integrity, and availability. No exploit availabili...

CVE-2026-68786

CVE-2026-68786 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network with no user interaction. The assigned CVSS 3.1 score is 8.8 (HIGH) with impacts of High across confidentiality, inte...

CVE-2026-77488

Microsoft SQL Server is affected by an integer underflow (wrap or wraparound) that allows an authorized local attacker to disclose information. The flaw requires low privileges and no user interaction, with a CVSS 3.1 score of 5.5 (MEDIUM) — high confidentiality impact but no integrity or availab...

CVE-2026-67633

Microsoft SQL Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges) to trigger a denial of service over the network. The CNA-assigned CVSS 3.1 score is 6.5 (MEDIUM) , reflecting network attack vector, low complexity, and high availability im...

CVE-2026-67645

CVE-2026-67645 is an out-of-bounds read in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS 3.1 base score is 6.5 (MEDIUM) , reflecting low complexity, low privileges required, and high confidentiality impact with no integrity or availabili...

CVE-2026-67648

Microsoft SQL Server is affected by a use of uninitialized resource vulnerability that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidential...

CVE-2026-68787

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker with low privileges to execute code locally. The flaw requires no user interaction and results in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 – HIGH , vector AV:L/AC:L/PR:L/...

CVE-2026-67380

CVE-2026-67380 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires network access,...

CVE-2026-68775

Microsoft SQL Server is affected by a heap-based buffer overflow vulnerability that allows an authorized attacker (with low privileges) to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impa...

CVE-2026-68780

CVE-2026-68780 is an out-of-bounds read in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network. The CVSS 3.1 score is 6.5 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , reflecting high confidentiality impact with no ...

CVE-2026-68784

CVE-2026-68784 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS v3.1 score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a high confidentiality impact with low priv...

CVE-2026-67368

Microsoft SQL Server is affected by an improper link resolution before file access ('link following') flaw that allows an authorized attacker to elevate privileges over a network. The root cause is a link following issue in how SQL Server resolves file links prior to access. Per the assigned CVSS...

CVE-2026-68776

CVE-2026-68776 is an information disclosure vulnerability in Microsoft SQL Server caused by a use of uninitialized resource . An authorized attacker can exploit this over a network to disclose sensitive information. The CNA-assigned CVSS 3.1 score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI...

CVE-2026-77481

CVE-2026-77481 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network . The CVSS 3.1 base score is 8.8 (HIGH) , with high impact to confidentiality, integrity, and availability, and no us...

CVE-2026-67376

CVE-2026-67376 is an integer overflow or wraparound flaw in Microsoft SQL Server that allows an unauthorized, remote attacker to trigger a denial of service over the network. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating low attack complexity, n...

CVE-2026-68785

Microsoft SQL Server is affected by a heap-based buffer overflow that allows an authorized attacker (high privileges required) to execute code over a network. The CVSS v3.1 score is 4.9 (Medium) , reflecting a network attack vector with low complexity, high privileges required, and no user intera...

CVE-2026-68777

CVE-2026-68777 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The CVSS 3.1 base score is 6.5 (Medium) with high confidentiality impact but no integrity or availability impact. CISA's SSVC assessment rates e...

CVE-2026-77480

SQL Server is affected by an elevation of privilege vulnerability caused by insufficient granularity of access control . An authorized attacker with low privileges can exploit the flaw over a network to elevate their access, resulting in high impact to confidentiality, integrity, and availability...

CVE-2026-67390

CVE-2026-67390 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network with low attack complexity and no user interaction. The CVSS 3.1 score is 6.5 (Medium) , reflecting high confidentiality i...

CVE-2026-73028

Microsoft SQL Server is affected by an improper access control vulnerability (CVE-2026-73028) that allows an authorized attacker to elevate privileges over a network . The vulnerability is rated HIGH severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating low ...

CVE-2026-68781

CVE-2026-68781 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The flaw requires low privileges and no user interaction , with low attack complexity . The CVSS 3.1 base score is 6.5 (MEDIUM) , reflecting a h...