CVE-2026-40370

CVE-2026-40370 is a SQL Server Remote Code Execution vulnerability described across multiple sources as external control of a file name or path that can allow an authorized attacker to run code over the network. Connected documents enumerate affected SQL Server components and versions (e.g., SQL ...

CVE-2026-47295

CVE-2026-47295 describes an elevation-of-privilege vulnerability in Microsoft SQL Server caused by improper neutralization of special elements used in SQL commands (SQL injection). The issue can be exploited by an authenticated attacker over a network to gain elevated privileges, with impact on c...

CVE-2026-54117

Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...

CVE-2026-47296

CVE-2026-47296 is an elevation-of-privilege vulnerability in Microsoft SQL Server caused by improper neutralization of special elements used in a SQL command (SQL injection). An authorized attacker operating locally with low privileges and no user interaction can escalate privileges (impacting co...

CVE-2026-54118

Microsoft SQL Server (2019, 2022, 2025) is vulnerable to deserialization of untrusted data leading to remote code execution (CVSS 9.8, no authentication required). No in-the-wild exploitation is reported (SSVC: Exploitation none). Microsoft released July 14, 2026 patches: KB5101346 (SQL 2025 CU6)...

CVE-2026-26115

CVE-2026-26115: Microsoft SQL Server Elevation of Privilege due to improper validation of input. Affects Microsoft SQL Server; vulnerability is exploitable over a network by an authorized attacker with LOW privileges; CVSS v3.1 base score 8.8 (High). Connected sources also reference related bugs ...

CVE-2026-32167

CVE-2026-32167 is a SQL Server Elevation of Privilege vulnerability caused by improper neutralization of input in SQL commands. An authorized local attacker could elevate privileges. Microsoft security updates address this CVE (e.g., KB5084815/KB5084816 for SQL Server 2022/2019 CU releases; relat...

CVE-2026-21262

CVE-2026-21262 affects Microsoft SQL Server and is a privilege-escalation vulnerability caused by improper access control. An authorized, network-present attacker with low privileges can elevate to sysadmin, potentially reading/changing data, creating accounts, or altering configurations, as desc...

CVE-2026-32176

CVE-2026-32176 arises from improper neutralization of input in SQL Server, enabling an authorized local user to elevate privileges. Connected sources confirm this is one of multiple SQL Server elevation-of-privilege issues addressed in the Microsoft April 2026 security updates (e.g., KB5084815 fo...

CVE-2026-33120

CVE-2026-33120 affects Microsoft SQL Server and is a remote code execution vulnerability. The entry documents a network-based exploit with low attack complexity and low privileges required, resulting in high impact to confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8 (...

CVE-2026-26116

CVE-2026-26116 is a SQL Server Elevation of Privilege vulnerability due to improper neutralization of special elements in SQL commands. Affected product: Microsoft SQL Server (SQL Server 2025 GDR) with potential network‑based exploitation and high impact (CVE-2026-26116). The issue is mitigated b...

CVE-2026-20803

CVE-2026-20803 is a Microsoft SQL Server elevation of privilege vulnerability. The issue allows an authenticated attacker to gain elevated privileges on the SQL Server instance over a network, due to missing authentication for a critical function. Connected advisories confirm exploitation risk an...

CVE-2026-55002

Technical details about CVE-2026-55002 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-67378

CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 9.0 (Critical) with a high attack complexity, no required privileges, and a changed scope (impact: high across con...

CVE-2026-67643

CVE-2026-67643 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. Microsoft assigned a CVSS 3.1 score of 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment rates exp...

CVE-2026-78456

CVE-2026-78456 affects Microsoft SQL Server and is caused by a heap-based buffer overflow that allows an authorized attacker (low privileges required) to achieve remote code execution over the network. The CVSS v3.1 score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflect...

CVE-2026-67636

CVE-2026-67636 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CNA-assigned CVSS 3.1 score is 9.0 (CRITICAL) , with a network attack vector, high complexity, no required privileges, changed sc...

CVE-2026-66819

CVE-2026-66819 is an SQL injection vulnerability in Microsoft SQL Server , caused by improper neutralization of special elements used in SQL commands. An authorized attacker can exploit it over a network to elevate privileges , with a CVSS 3.1 score of 8.8 (HIGH) and impacts rated High for confid...

CVE-2026-66814

Microsoft SQL Server is affected by an insufficient granularity of access control flaw that allows an authorized attacker to elevate privileges over a network. The vulnerability is rated CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that low-privilege network ac...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating no privileges or user in...

CVE-2026-77485

CVE-2026-77485 is a use-after-free vulnerability in Microsoft SQL Server that allows an authorized attacker to elevate privileges locally . The flaw requires local access and low privileges, with high attack complexity and no user interaction, scoring CVSS 3.1 7.0 (HIGH) with full impact on confi...

CVE-2026-77487

CVE-2026-77487 is an improper access control vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to elevate privileges over a network with low complexity and no user interaction. The CVSS 3.1 base score is 8.8 (HIGH) , with high impact to confidentia...

CVE-2026-67388

CVE-2026-67388 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over the network. The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating low attack ...

CVE-2026-68779

CVE-2026-68779 is an out-of-bounds read in Microsoft SQL Server that allows an authorized (low-privilege) attacker to disclose information over a network. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N , indicating a high confidentiality impact with no int...

CVE-2026-66818

Microsoft SQL Server is affected by an improper privilege management flaw that allows an authorized attacker to escalate privileges over a network . The vulnerability is rated CVSS 3.1 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low privileges and no user interaction ...

CVE-2026-67381

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) , with an attack vector of network, low complexity, low privileges required, and no user interaction needed, resulting in high impact to confi...

CVE-2026-77484

CVE-2026-77484 is a remote code execution vulnerability in Microsoft SQL Server caused by deserialization of untrusted data , allowing an authorized attacker to execute code over a network. The CVSS v3.1 score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-explo...

CVE-2026-68778

CVE-2026-68778 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an authorized attacker (low privileges required) to disclose information over a network . The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidential...

CVE-2026-67379

CVE-2026-67379 is a stack-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over the network. The CVSS 3.1 score is 8.5 (HIGH) with a scope change, reflecting high impact on confidentiality, integrity, and availabili...

CVE-2026-67384

Microsoft SQL Server is affected by an integer overflow or wraparound vulnerability that allows an authorized attacker to execute code over a network, leading to a remote code execution scenario. The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, and low privileges req...

CVE-2026-67370

CVE-2026-67370 is an SQL injection vulnerability in Microsoft SQL Server where improper neutralization of special elements used in a SQL command allows an authorized attacker to elevate privileges over a network. The vulnerability carries a CVSS v3.1 score of 8.8 (HIGH) with a vector of AV:N/AC:L...

CVE-2026-67386

Microsoft SQL Server is affected by a use of uninitialized resource flaw that allows an authorized attacker (low privileges) to disclose information over a network. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high con...

CVE-2026-77483

CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...

CVE-2026-67385

Microsoft SQL Server is affected by a use-after-free vulnerability that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment indicates no known exploit...

CVE-2026-67633

Microsoft SQL Server is affected by an out-of-bounds read vulnerability that allows an authorized attacker (low privileges) to trigger a denial of service over the network. The CNA-assigned CVSS 3.1 score is 6.5 (MEDIUM) , reflecting network attack vector, low complexity, and high availability im...

CVE-2026-68786

CVE-2026-68786 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network with no user interaction. The assigned CVSS 3.1 score is 8.8 (HIGH) with impacts of High across confidentiality, inte...

CVE-2026-67393

CVE-2026-67393 is a buffer over-read vulnerability in Microsoft SQL Server that allows an authorized attacker to disclose information over a network. The vulnerability is classified as information disclosure with a CVSS 3.1 base score of 6.5 (Medium) , requiring low privileges and no user interac...

CVE-2026-67641

Microsoft SQL Server is affected by an integer overflow or wraparound vulnerability that allows an authorized attacker (low privileges) to trigger a denial of service over a network with low complexity and no user interaction. The CVSS 3.1 score is 6.5 (Medium) , with the primary impact on availa...

CVE-2026-67645

CVE-2026-67645 is an out-of-bounds read in Microsoft SQL Server that allows an authorized attacker to disclose information over a network . The CVSS 3.1 base score is 6.5 (MEDIUM) , reflecting low complexity, low privileges required, and high confidentiality impact with no integrity or availabili...

CVE-2026-67648

Microsoft SQL Server is affected by a use of uninitialized resource vulnerability that allows an authorized attacker (low privileges) to disclose information over a network . The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidential...

CVE-2026-77488

Microsoft SQL Server is affected by an integer underflow (wrap or wraparound) that allows an authorized local attacker to disclose information. The flaw requires low privileges and no user interaction, with a CVSS 3.1 score of 5.5 (MEDIUM) — high confidentiality impact but no integrity or availab...

CVE-2026-66820

CVE-2026-66820 is an SQL injection vulnerability in SQL Server caused by improper neutralization of special elements in a SQL command. An authorized attacker with low privileges can exploit it over the network without user interaction to elevate privileges , resulting in high impact to confidenti...

CVE-2026-67639

CVE-2026-67639 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (HIGH) with full impact to confidentiality, integrity, and availability. No exploit availabili...

CVE-2026-67380

CVE-2026-67380 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires network access,...

CVE-2026-68775

Microsoft SQL Server is affected by a heap-based buffer overflow vulnerability that allows an authorized attacker (with low privileges) to achieve remote code execution over a network. The CVSS 3.1 base score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impa...

CVE-2026-68787

A heap-based buffer overflow in Microsoft SQL Server allows an authorized attacker with low privileges to execute code locally. The flaw requires no user interaction and results in high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8 – HIGH , vector AV:L/AC:L/PR:L/...

CVE-2026-77481

CVE-2026-77481 is a heap-based buffer overflow in Microsoft SQL Server that allows an authorized attacker (low privileges required) to achieve remote code execution over a network . The CVSS 3.1 base score is 8.8 (HIGH) , with high impact to confidentiality, integrity, and availability, and no us...

CVE-2026-66816

Microsoft SQL Server is affected by a security feature bypass vulnerability caused by insufficient logging , allowing an authorized attacker with low privileges to bypass a security feature over a network. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a High confidentiality impa...

CVE-2026-68776

CVE-2026-68776 is an information disclosure vulnerability in Microsoft SQL Server caused by a use of uninitialized resource . An authorized attacker can exploit this over a network to disclose sensitive information. The CNA-assigned CVSS 3.1 score is 6.5 (Medium) with the vector AV:N/AC:L/PR:L/UI...

CVE-2026-68785

Microsoft SQL Server is affected by a heap-based buffer overflow that allows an authorized attacker (high privileges required) to execute code over a network. The CVSS v3.1 score is 4.9 (Medium) , reflecting a network attack vector with low complexity, high privileges required, and no user intera...