Microsoft SQL Server 2022 vulnerabilities

166 CVEs affecting Microsoft SQL Server 2022, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78456, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-49719, published 2025-07-08. High severity, CVSS 7.5. EPSS: 15.5% chance of exploitation in the next 30 days. Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2025-49718, published 2025-07-08. High severity, CVSS 7.5. EPSS: 3.9% chance of exploitation in the next 30 days. Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
• CVE-2024-28910, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-29985, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28936, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28934, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28933, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28932, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28931, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
• CVE-2024-28909, published 2024-04-09. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Latest

• CVE-2026-78456, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77488, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
• CVE-2026-77487, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77485, published 2026-09-08. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-77484, published 2026-09-08. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77483, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77481, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77480, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-73029, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-73028, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.