Microsoft SQL Server Management Studio vulnerabilities

8 CVEs affecting Microsoft SQL Server Management Studio, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-65669, published 2026-09-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-8533, published 2018-10-10. Medium severity, CVSS 5.5. EPSS: 23.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server…
CVE-2018-8532, published 2018-10-10. Medium severity, CVSS 5.5. EPSS: 23.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server…
CVE-2018-8527, published 2018-10-10. Medium severity, CVSS 5.5. EPSS: 23.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server…
CVE-2019-1376, published 2019-10-10. Medium severity, CVSS 6.5. EPSS: 5.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Management Studio Information Disclosure…
CVE-2019-1313, published 2019-10-10. Medium severity, CVSS 6.5. EPSS: 5.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Management Studio Information Disclosure…
CVE-2020-1455, published 2020-08-17. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. A denial of service vulnerability exists when Microsoft SQL Server Management Studio (SSMS) improperly handles files. An attacker could exploit the vulnerability to trigger a denial of service. To…
CVE-2026-65669, published 2026-09-08. Critical severity, CVSS 9.6. EPSS: 0.9% chance of exploitation in the next 30 days. Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-29803, published 2025-04-12. High severity, CVSS 7.3. EPSS: 0.8% chance of exploitation in the next 30 days. Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.