Microsoft SQL Server 2025 (Cu8) vulnerabilities
69 vulnerabilities
Known vulnerabilities in Microsoft SQL Server 2025 (Cu8), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-85876microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+6
EPSS score0.20%
Use after free in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-83945microsoftmicrosoft sql server 2022 for x64-based systems (cu27)+4EPSS score0.42%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-70189microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.26%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-68883microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.39%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-88089microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.24%
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.CVE-2026-88088microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+6EPSS score0.18%
Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-88086microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+6EPSS score0.27%
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.CVE-2026-88085microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.19%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-88084microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+2EPSS score0.45%
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.CVE-2026-88083microsoftmicrosoft sql server 2022 (cu 26)+5EPSS score0.35%
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-88082microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+6EPSS score0.18%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-88081microsoftmicrosoft sql server 2017 for x64-based systems (cu31)+8EPSS score0.53%
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-85919microsoftmicrosoft sql server 2019 for x64-based systems (cu32)+6EPSS score0.18%
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.CVE-2026-73028microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-73029microsoftmicrosoft sql server 2019 (cu 32)+8EPSS score1.00%
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-77488microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.40%
Integer underflow (wrap or wraparound) in SQL Server allows an authorized attacker to disclose information locally.CVE-2026-77480microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-77487microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-77483microsoftmicrosoft sql server 2017 (cu 31)+11EPSS score0.78%
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-77484microsoftmicrosoft sql server 2019 (cu 32)+8EPSS score1.69%
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.