Product by Microsoft

Microsoft SQL Server

108 known vulnerabilities in Microsoft SQL Server (Microsoft), 3 of them actively exploited (CISA KEV).

108

Vulnerabilities

Actively exploited (KEV)

Used by ransomware

Critical

Vulnerabilities

Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

Vulnerabilities in Microsoft SQL Server (Microsoft)

Critical	CVE-2020-0618	Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability In CISA KEVRansomwarealso in 1 other product	8.8	11.02.2020
Critical	CVE-2012-1856	Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability In CISA KEValso in 6 other products	8.8	15.08.2012
Critical	CVE-2019-1068	Microsoft SQL Server Remote Code Execution Vulnerability In CISA KEValso in 3 other products	8.8	15.07.2019
Critical	CVE-2018-8273	Microsoft SQL Server: Buffer Overflow also in 1 other product	9.8	15.08.2018
High	CVE-2016-7250	Microsoft SQL Server: Privilege Escalation	8.8	10.11.2016
High	CVE-2016-7254	Microsoft SQL Server: Privilege Escalation	8.8	10.11.2016
High	CVE-2016-7249	Microsoft SQL Server: Privilege Escalation	8.8	10.11.2016
High	CVE-2016-7253	Microsoft SQL Server: Privilege Escalation	8.8	10.11.2016
High	CVE-2009-2502	Microsoft SQL Server: Buffer Overflow also in 25 other products	8.1	14.10.2009
High	CVE-2021-1636	Microsoft SQL Elevation of Privilege Vulnerability also in 6 other products	8.8	12.01.2021
High	CVE-2017-8516	Microsoft SQL Server: Information Disclosure also in 1 other product	7.5	08.08.2017
High	CVE-2002-1872	Microsoft SQL Server: security vulnerability	7.5	28.06.2005
Medium	CVE-2016-7252	Microsoft SQL Server: Information Disclosure	6.5	10.11.2016
Medium	CVE-2016-7251	Microsoft SQL Server: Cross-Site Scripting (XSS)	6.1	10.11.2016
Medium	CVE-2019-0819	Microsoft SQL Server: Information Disclosure	6.5	16.05.2019
High	CVE-2023-21713	Microsoft SQL Server Remote Code Execution Vulnerability also in 11 other products	8.8	14.02.2023
High	CVE-2022-29143	Microsoft SQL Server Remote Code Execution Vulnerability also in 6 other products	7.5	15.06.2022
High	CVE-2023-38169	Microsoft SQL OLE DB Remote Code Execution Vulnerability also in 10 other products	8.8	08.08.2023
High	CVE-2024-0056	Microsoft.Data.SqlClient: Cleartext Transmission of Sensitive Information also in 17 other products	8.7	09.01.2024
High	CVE-2023-21705	Microsoft SQL Server Remote Code Execution Vulnerability also in 11 other products	8.8	14.02.2023
Not rated	CVE-2000-0402	Microsoft SQL Server: security vulnerability	—	12.07.2000
Not rated	CVE-2008-5416	Microsoft SQL Server: Heap-Based Buffer Overflow	—	10.12.2008
Not rated	CVE-2002-0649	Microsoft SQL Server: Buffer Overflow also in 1 other product	—	26.07.2002
Not rated	CVE-2002-1123	Microsoft SQL Server: Buffer Overflow also in 1 other product	—	01.09.2004
Not rated	CVE-2008-0086	Microsoft SQL Server: Buffer Overflow also in 2 other products	—	08.07.2008

All vulnerabilities in search

News

CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlinessans-newsbites-mail, 28.08.2026
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugsthehackernews, 27.08.2026
SSA-472448 V1.0: Security Bypass Vulnerability in the SQL Client-Server Communication in Siveillance Videosiemens-productcert

All products by Microsoft

Key figures

Vulnerabilities

News