Product by Microsoft
Microsoft SQL Server 2016
100 known vulnerabilities in Microsoft SQL Server 2016 (Microsoft), 1 of them actively exploited (CISA KEV).
Key figures
100
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2019-1068 | Microsoft SQL Server Remote Code Execution Vulnerability In CISA KEV | 8.8 | |
| High | CVE-2025-49719 | Microsoft SQL Server Information Disclosure Vulnerability | 7.5 | |
| Critical | CVE-2026-54118 | Microsoft SQL Server Remote Code Execution Vulnerability | 9.8 | |
| Critical | CVE-2026-54117 | Microsoft SQL Server Remote Code Execution Vulnerability | 9.8 | |
| High | CVE-2026-21262 | SQL Server Elevation of Privilege Vulnerability | 8.8 | |
| High | CVE-2025-24999 | Microsoft SQL Server Elevation of Privilege Vulnerability | 8.8 | |
| High | CVE-2024-35271 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-37332 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-35272 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-37318 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-37331 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21414 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21398 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21428 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21373 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21333 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21332 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-43459 | SQL Server Native Client Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-38255 | SQL Server Native Client Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-48996 | SQL Server Native Client Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-48994 | SQL Server Native Client Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21415 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-21335 | SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | 8.8 | |
| High | CVE-2024-37965 | Microsoft SQL Server Elevation of Privilege Vulnerability | 8.8 | |
| High | CVE-2025-55227 | Microsoft SQL Server Elevation of Privilege Vulnerability | 8.8 |
News
- CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlinessans-newsbites-mail,
- CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugsthehackernews,
- Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bugcsoonline,
- NCSC-2026-0232 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft SQL Serverncsc-nl,