Microsoft SQL Server 2019 (CU 32) vulnerabilities
71 vulnerabilities
Known vulnerabilities in Microsoft SQL Server 2019 (CU 32), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-59499microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score1.18%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-55227microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.42%
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-47997microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score0.87%
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.CVE-2025-53727microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.16%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-24999microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.71%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-49758microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score0.97%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-49717microsoftmicrosoft sql server 2019 (cu 32)+5EPSS score1.12%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2025-49759microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11EPSS score1.17%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2025-49719microsoftmicrosoft sql server 2016 for service pack 2 (gdr)+11EPSS score15.50%
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.CVE-2025-49718microsoftmicrosoft sql server 2019 (cu 32)+5EPSS score3.90%
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.CVE-2026-21262microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+14EPSS score2.08%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-54118microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+14EPSS score1.53%
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-73028microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-73029microsoftmicrosoft sql server 2019 (cu 32)+8EPSS score1.00%
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-40370microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+14EPSS score1.01%
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-77488microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.40%
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.CVE-2026-77480microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-77487microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-77482microsoftmicrosoft sql server 2017 (cu 31)+5EPSS score0.82%
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-77486microsoftmicrosoft sql server 2017 (cu 31)+5EPSS score0.82%
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network.