CVE-2024-37341

CVE-2024-37341 is a Microsoft SQL Server Elevation of Privilege vulnerability. Connected docs confirm the issue affects SQL Server components and was patched via KB5046062 (security update for SQL Server 2016 SP3 Azure Connect Feature Pack). The update lists SQL Server builds such as SQLServer201...

CVE-2026-54117

Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...

CVE-2026-54118

Microsoft SQL Server (2019, 2022, 2025) is vulnerable to deserialization of untrusted data leading to remote code execution (CVSS 9.8, no authentication required). No in-the-wild exploitation is reported (SSVC: Exploitation none). Microsoft released July 14, 2026 patches: KB5101346 (SQL 2025 CU6)...

CVE-2024-37980

CVE-2024-37980 is a Microsoft SQL Server Elevation of Privilege vulnerability. Connected sources confirm affected product family as Microsoft SQL Server (various editions/versions in scope). The root cause involves an Elevation of Privilege issue likely exploitable by an authenticated remote atta...

CVE-2026-67378

CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 9.0 (Critical) with a high attack complexity, no required privileges, and a changed scope (impact: high across con...

CVE-2026-67643

CVE-2026-67643 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. Microsoft assigned a CVSS 3.1 score of 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment rates exp...

CVE-2026-67636

CVE-2026-67636 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CNA-assigned CVSS 3.1 score is 9.0 (CRITICAL) , with a network attack vector, high complexity, no required privileges, changed sc...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating no privileges or user in...