Technology · Microsoft
Microsoft SQL Server vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 140 vulnerabilities in Microsoft SQL Server: 53 in the last 7 days and 136 in the last 90 days, 9 of them critical and 3 exploited in the wild. The most recent, CVE-2026-94513, was published on 10 November 2026. 22 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 53
- Last 90 days
- 136
- Critical, all time
- 9
- Exploited in the wild
- 3
About Microsoft SQL Server
Relational database management system for storing, retrieving, and managing structured data.
Latest Microsoft SQL Server vulnerabilities
- CVE-2026-94513: Microsoft SQL Server heap-based buffer overflowhighCVSS 8
- CVE-2026-94511: Microsoft SQL Server heap-based buffer overflowhighCVSS 8.8
- CVE-2026-88111: Microsoft SQL Server heap buffer overflowhighCVSS 7.5
- CVE-2026-84010: Microsoft SQL Server privilege escalation via exposed methodhighCVSS 7.5
- CVE-2026-68783: Microsoft SQL Server information disclosure via uninitialized resourcemediumCVSS 6.5
- CVE-2026-67646: Microsoft SQL Server heap buffer overflowhighCVSS 8.8
- CVE-2026-67637: Microsoft SQL Server heap-based buffer overflowhighCVSS 8.8
- CVE-2026-67632: Microsoft SQL Server heap-based buffer overflowhighCVSS 8.8
- CVE-2026-67391: Microsoft SQL Server heap-based buffer overflowhighCVSS 8.8
- CVE-2026-67387: Microsoft SQL Server untrusted pointer dereference privilege escalationhighCVSS 8.8
- CVE-2026-67382: Microsoft SQL Server uninitialized resource information disclosuremediumCVSS 6.5
- CVE-2026-67375: Microsoft SQL Server stack-based buffer overflow privilege escalationhighCVSS 8.8
- CVE-2026-67374: Microsoft SQL Server heap buffer overflowhighCVSS 8.8
- CVE-2026-67372: Microsoft SQL Server heap buffer overflowhighCVSS 8.8
- CVE-2026-66813: Microsoft SQL Server out-of-bounds read privilege escalationhighCVSS 8.1
- CVE-2026-62903: Microsoft SQL Server authentication bypass in capture-replayhighCVSS 7.4
- CVE-2026-118120: Microsoft SQL Server SQL injection privilege escalationhighCVSS 8.8
- CVE-2026-118119: Microsoft SQL Server SQL injection privilege escalationhighCVSS 8
- CVE-2026-118118: Microsoft SQL Server SQL injection in privilege elevationhighCVSS 8
- CVE-2026-118117: Microsoft SQL Server SQL injection privilege elevationhighCVSS 8
- CVE-2026-118116: Microsoft SQL Server SQL injection privilege escalationhighCVSS 7
- CVE-2026-118115: Microsoft SQL Server SQL injection privilege elevationhighCVSS 7.5
- CVE-2026-118114: Microsoft SQL Server SQL injection privilege elevationhighCVSS 7.5
- CVE-2026-118113: Microsoft SQL Server SQL injection privilege elevationhighCVSS 8
- CVE-2026-118112: Microsoft SQL Server code injection privilege escalationhighCVSS 8
Most severe Microsoft SQL Server vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-0618: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-1068: Microsoft SQL Server remote code executioncriticalexploited in the wildEPSS 57.9%
- CVE-2026-67643: Microsoft SQL Server heap-based buffer overflowcriticalCVSS 9.8EPSS 1.0%
- CVE-2026-67631: Microsoft SQL Server heap buffer overflowcriticalCVSS 9.8EPSS 1.0%
- CVE-2026-116945: Microsoft SQL Server heap-based buffer overflowcriticalCVSS 9.8
- CVE-2026-65669: Microsoft SQL Server SQL injection privilege escalationcriticalCVSS 9.6EPSS 0.9%
- CVE-2026-67636: Microsoft SQL Server out-of-bounds read allows remote code executioncriticalCVSS 9EPSS 0.7%
- CVE-2026-67378: Microsoft SQL Server untrusted pointer dereferencecriticalCVSS 9EPSS 0.7%
- CVE-2026-77484: Microsoft SQL Server unsafe deserialization remote code executionhighCVSS 8.8EPSS 1.7%
Vulnerabilities per week
22 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 1 | 1 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 60 | 5 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 22 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 53 | 1 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Microsoft SQL Server vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/sql-server)<a href="https://junglewise.ai/threats/technologies/sql-server"><img src="https://junglewise.ai/threats/technologies/sql-server/badge.svg" alt="Microsoft SQL Server vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/sql-server.json, and this page as text at https://junglewise.ai/threats/technologies/sql-server.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Microsoft SQL Server vulnerabilities", https://junglewise.ai/threats/technologies/sql-server, 13 November 2026.