Microsoft SQL Server 2019 (CU 32) vulnerabilities

12 known vulnerabilities in Microsoft SQL Server 2019 (CU 32) from Microsoft. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-67370Sep 8, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-66820Sep 8, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-66819Sep 8, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-47295Jul 14, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 7.5 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-47296Jul 14, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 7.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-32176Apr 14, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-32167Apr 14, 2026Microsoft

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-59499Nov 11, 2025MicrosoftEPSS 1.18%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in a Command

  CVE-2025-55227Sep 9, 2025MicrosoftEPSS 1.42%

  Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-53727Aug 12, 2025MicrosoftEPSS 1.37%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-49759Aug 12, 2025MicrosoftEPSS 1.28%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Privilege Management

  CVE-2025-49758Aug 12, 2025MicrosoftEPSS 1.07%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.