Microsoft SQL Server 2022 (CU 20) vulnerabilities

5 known vulnerabilities in Microsoft SQL Server 2022 (CU 20) from Microsoft. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in a Command

  CVE-2025-55227Sep 9, 2025MicrosoftEPSS 1.42%

  Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-53727Aug 12, 2025MicrosoftEPSS 1.37%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-49759Aug 12, 2025MicrosoftEPSS 1.28%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Privilege Management

  CVE-2025-49758Aug 12, 2025MicrosoftEPSS 1.07%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

• 8.8 High severity

  Microsoft SQL Server 2022 (CU 20): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-47954Aug 12, 2025MicrosoftEPSS 1.68%

  Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.