Microsoft SQL Server 2017 (Gdr) vulnerabilities
163 vulnerabilities
Known vulnerabilities in Microsoft SQL Server 2017 (Gdr), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-96956microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7
EPSS score0.42%
Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-85886microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.40%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-70189microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.26%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-68883microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.39%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-67625microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.39%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-94520microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.61%
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-94512microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.49%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-88089microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.24%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-88085microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.19%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-88081microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.53%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-85888microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.53%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-67628microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+7EPSS score0.54%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2021-1636microsoftmicrosoft sql server 2012 for x64-based systems service pack 4 (qfe)+10EPSS score6.69%
Microsoft SQL Elevation of Privilege VulnerabilityCVE-2025-59499microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.18%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-55227microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.42%
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-47997microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score0.87%
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.CVE-2025-53727microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.16%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-24999microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.71%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-49758microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score0.97%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-49759microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.17%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.