Microsoft SQL Server 2022 (CU 20) vulnerabilities

7 vulnerabilities

Known vulnerabilities in Microsoft SQL Server 2022 (CU 20), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2025-55227microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
1.42%
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.8.8CVE-2025-47954microsoftmicrosoft sql server 2022 (cu 20)+2
EPSS score
1.54%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.6.5CVE-2025-47997microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
0.87%
Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.8.8CVE-2025-53727microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
1.16%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.8.8CVE-2025-24999microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
1.71%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.8.8CVE-2025-49758microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
0.97%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.8.8CVE-2025-49759microsoftmicrosoft sql server 2016 service pack 3 azure connect feature pack+11
EPSS score
1.17%
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.