Microsoft SQL Server 2017 vulnerabilities

147 CVEs affecting Microsoft SQL Server 2017, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78442, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability, published 2019-07-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 57.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
• CVE-2025-49719, published 2025-07-08. High severity, CVSS 7.5. EPSS: 15.5% chance of exploitation in the next 30 days. Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2024-37966, published 2024-09-10. High severity, CVSS 7.1. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
• CVE-2026-21262, published 2026-03-10. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2024-37332, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37331, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-37318, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35272, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-35271, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
• CVE-2024-21414, published 2024-07-09. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

Latest

• CVE-2026-78442, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-78441, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.
• CVE-2026-77488, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
• CVE-2026-77487, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77486, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-77485, published 2026-09-08. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-77483, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77482, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-77481, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77480, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.