Microsoft SQL Server 2016 vulnerabilities

100 CVEs affecting Microsoft SQL Server 2016, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47295, published 2026-07-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability, published 2019-07-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 57.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
• CVE-2025-49719, published 2025-07-08. High severity, CVSS 7.5. EPSS: 15.5% chance of exploitation in the next 30 days. Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2026-21262, published 2026-03-10. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2024-37332, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37331, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37318, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35272, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35271, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21414, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21398, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

Latest

• CVE-2026-47295, published 2026-07-14. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-55002, published 2026-07-14. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-54118, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-54117, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-47296, published 2026-07-14. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-40370, published 2026-05-12. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-33120, published 2026-04-14. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-32176, published 2026-04-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-32167, published 2026-04-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-26116, published 2026-03-10. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.