Microsoft SQL Server 2025 vulnerabilities

71 CVEs affecting Microsoft SQL Server 2025, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77488, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-21262, published 2026-03-10. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77484, published 2026-09-08. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-54118, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-54117, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-20803, published 2026-01-13. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-67376, published 2026-09-08. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
• CVE-2026-67641, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
• CVE-2026-67633, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network.
• CVE-2026-68785, published 2026-09-08. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-47297, published 2026-09-08. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

Latest

• CVE-2026-77488, published 2026-09-08. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.
• CVE-2026-77487, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77485, published 2026-09-08. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in SQL Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-77483, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-77481, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
• CVE-2026-77480, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-73029, published 2026-09-08. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
• CVE-2026-73028, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-68787, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.