Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Microsoft
Sql Server

Microsoft sql server Vulnerabilities: CVEs, CISA KEV & Security Advisories

110 CVEs

2 in CISA KEV

Microsoft sql server Vulnerabilities

CVE security advisories and vulnerability history for sql server by Microsoft.

110

Total CVEs

Published

2

In CISA KEV

Exploited in the wild

24

Public exploits

With known exploit

8.0

Avg CVSS

2000–2024

Last updated January 9, 2024

Overview

Microsoft sql server has 110 published CVE records since 2000, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 24 have a known public exploit. The average CVSS base score across scored CVEs is 8.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Microsoft sql server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Microsoft sql server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High22

Medium1

Low0

85 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of Microsoft sql server's CVEs are confirmed exploited in the wild.

Public exploits

24

24 of Microsoft sql server's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Microsoft sql server version named in a CVE, then pick one to see only the CVEs that affect it.

No specific affected versions are recorded for Microsoft sql server; the CVEs below apply to the product without a version pin.

110 CVEs

Sort

High vulnerability · 2024-01-09
CVE-2024-0056
Patch
CWE-319
High · CVSS 8.7
EPSS 0.9% (75th pct)2024-01-09
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-36785
Patch
CWE-191
High · CVSS 7.8
EPSS 0.5% (66th pct)2023-10-10
High vulnerability · 2023-10-10
CVE-2023-36417
Patch
CWE-122
High · CVSS 7.8
EPSS 0.4% (63th pct)2023-10-10
High vulnerability · 2023-10-10
CVE-2023-36420
Patch
CWE-415
High · CVSS 7.8
EPSS 0.4% (63th pct)2023-10-10
Medium vulnerability · 2023-10-10
CVE-2023-36728
Patch
CWE-125
Medium · CVSS 5.5
EPSS 0.1% (24th pct)2023-10-10
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-36730
Patch
CWE-122
High · CVSS 7.8
EPSS 0.5% (65th pct)2023-10-10
Microsoft SQL OLE DB Remote Code Execution Vulnerability
CVE-2023-38169
Patch
CWE-416
High · CVSS 8.8
EPSS 0.4% (63th pct)2023-08-08
High vulnerability · 2023-06-16
CVE-2023-29349
Patch
CWE-191
High · CVSS 7.8
EPSS 0.6% (70th pct)2023-06-16
High vulnerability · 2023-06-16
CVE-2023-32028
Patch
CWE-122
High · CVSS 7.8
EPSS 1.1% (79th pct)2023-06-16
High vulnerability · 2023-06-16
CVE-2023-32027
Patch
CWE-122
High · CVSS 7.8
EPSS 1.2% (79th pct)2023-06-16
High vulnerability · 2023-06-16
CVE-2023-32026
Patch
CWE-122
High · CVSS 7.8
EPSS 1.2% (79th pct)2023-06-16
High vulnerability · 2023-06-16
CVE-2023-32025
Patch
CWE-122
High · CVSS 7.8
EPSS 1.2% (79th pct)2023-06-16
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-29356
Patch
CWE-416
High · CVSS 7.8
EPSS 0.6% (70th pct)2023-06-16
High vulnerability · 2023-04-11
CVE-2023-23384
Patch
CWE-122
High · CVSS 7.3
EPSS 1.5% (82th pct)2023-04-11
High vulnerability · 2023-02-14
CVE-2023-21713
Patch
CWE-502
High · CVSS 8.8
EPSS 2.1% (84th pct)2023-02-14
High vulnerability · 2023-02-14
CVE-2023-21718
Patch
CWE-191
High · CVSS 7.8
EPSS 0.6% (70th pct)2023-02-14
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-21705
Patch
CWE-321
High · CVSS 8.8
EPSS 0.7% (73th pct)2023-02-14
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-21704
Patch
CWE-190
High · CVSS 7.8
EPSS 1.2% (79th pct)2023-02-14
High vulnerability · 2023-02-14
CVE-2023-21528
Patch
CWE-122
High · CVSS 7.8
EPSS 0.2% (37th pct)2023-02-14
High vulnerability · 2022-06-15
CVE-2022-29143
Patch
High · CVSS 7.5
EPSS 2.8% (86th pct)2022-06-15
SQL Server for Linux Containers Elevation of Privilege Vulnerability
CVE-2022-23276
Patch
High · CVSS 7.8
EPSS 0.2% (42th pct)2022-02-09
High vulnerability · 2021-01-12
CVE-2021-1636
Patch
High · CVSS 8.8
EPSS 7.3% (92th pct)2021-01-12
Critical vulnerability · 2020-02-11
CVE-2020-0618
CISA KEV
Public exploit
CWE-502
Added to CISA KEV 2024-09-18
Critical · CVSS 9.3
EPSS 94.2% (100th pct)2020-02-11
Vulnerability · 2019-07-15
CVE-2019-1068
Unscored
EPSS 41.6% (97th pct)2019-07-15
Vulnerability · 2019-05-16
CVE-2019-0819
Unscored
EPSS 3.2% (87th pct)2019-05-16
Vulnerability · 2018-08-15
CVE-2018-8273
Unscored
EPSS 28.6% (97th pct)2018-08-15
Vulnerability · 2017-08-08
CVE-2017-8516
Unscored
EPSS 1.6% (82th pct)2017-08-08
Vulnerability · 2016-11-10
CVE-2016-7254
Unscored
EPSS 16.6% (95th pct)2016-11-10
Vulnerability · 2016-11-10
CVE-2016-7253
Unscored
EPSS 18.2% (95th pct)2016-11-10
Vulnerability · 2016-11-10
CVE-2016-7252
Unscored
EPSS 19.7% (96th pct)2016-11-10

Showing 30 of 110

Common weakness types

The CWE weakness categories most often found in Microsoft sql server CVEs. Follow any weakness for its full explanation.

CWE-122Heap-based Buffer Overflow8 CVEs
CWE-191Integer Underflow (Wrap or Wraparound)3 CVEs
CWE-416Use After Free2 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-321Use of Hard-coded Cryptographic Key1 CVE
CWE-415Double Free1 CVE
CWE-319Cleartext Transmission of Sensitive Information1 CVE
CWE-125Out-of-bounds Read1 CVE

Disclosure activity by year

How many Microsoft sql server CVEs were published each year.

2012

3

2014

2

2015

3

2016

6

2017

1

2018

1

2019

2

2020

1

2021

1

2022

2

2023

18

2024

1

Other Microsoft products

Browse vulnerabilities for other products by Microsoft.

windows10,259 CVEs windows server 20165,207 CVEs windows server 20194,709 CVEs windows 104,437 CVEs windows server 20124,219 CVEs windows server 20084,083 CVEs Windows Server 2019 (Server Core installation)3,456 CVEs Windows 10 Version 18093,187 CVEs

All Microsoft vulnerabilities

Frequently asked questions

Common questions about Microsoft sql server vulnerabilities.

How many CVEs does Microsoft sql server have?

Microsoft sql server has 110 published CVE records since 2000.

How many Microsoft sql server CVEs are in CISA KEV?

Yes — 2 of Microsoft sql server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Microsoft sql server vulnerabilities?

Yes — 24 of Microsoft sql server's CVEs have a known public exploit.

What are the most common weakness types in Microsoft sql server CVEs?

Microsoft sql server's CVEs most often map to these CWE weakness types: CWE-122 (Heap-based Buffer Overflow), CWE-191 (Integer Underflow (Wrap or Wraparound)), CWE-416 (Use After Free), CWE-502 (Deserialization of Untrusted Data).

How many critical Microsoft sql server vulnerabilities are there?

Microsoft sql server has 2 critical and 22 high-severity CVEs.

What is the average severity of Microsoft sql server CVEs?

The average CVSS base score across Microsoft sql server's scored CVEs is 8.0.

References

All Microsoft vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Microsoft sql server vulnerabilities

Monitor new Microsoft sql server vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References