Microsoft SQL Server 2022 (GDR) vulnerabilities

25 known vulnerabilities in Microsoft SQL Server 2022 (GDR) from Microsoft. 25 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

25vulnerabilities

0critical

25high

0exploited

8.4average CVSS score

Latest first

8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118120Nov 10, 2026MicrosoftEPSS 1.12%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118119Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118118Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118117Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
7.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118116Nov 10, 2026MicrosoftEPSS 1.94%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
7.5 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118115Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
7.5 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118114Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118113Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118110Nov 10, 2026MicrosoftEPSS 1.12%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118109Nov 10, 2026MicrosoftEPSS 1.12%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-118105Nov 10, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in a Command
CVE-2026-116930Nov 10, 2026Microsoft
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.
8.8 High severity
Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-67370Sep 8, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-66820Sep 8, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2017 (CU 31): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-66819Sep 8, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-47295Jul 14, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
7.5 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-47296Jul 14, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
7.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-32176Apr 14, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
7.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2026-32167Apr 14, 2026Microsoft
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-59499Nov 11, 2025MicrosoftEPSS 1.18%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in a Command
CVE-2025-55227Sep 9, 2025MicrosoftEPSS 1.42%
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-53727Aug 12, 2025MicrosoftEPSS 1.37%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-49759Aug 12, 2025MicrosoftEPSS 1.28%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2016 Service Pack 3 (GDR): Improper Privilege Management
CVE-2025-49758Aug 12, 2025MicrosoftEPSS 1.07%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
8.8 High severity
Microsoft SQL Server 2022 (CU 20): Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-47954Aug 12, 2025MicrosoftEPSS 1.68%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.