Microsoft Microsoft SQL Server 2022 (Cu 26)
53 CVEs affecting Microsoft Microsoft SQL Server 2022 (Cu 26). Latest disclosed: 2026-10-13. Critical: 4, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-67643 | Critical | 9.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-67631 | Critical | 9.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-67636 | Critical | 9.0 | 2026-09-08 | Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-67378 | Critical | 9.0 | 2026-09-08 | Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network. |
CVE-2026-78456 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-77487 | High | 8.8 | 2026-09-08 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-77484 | High | 8.8 | 2026-09-08 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-77483 | High | 8.8 | 2026-09-08 | Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-77481 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-77480 | High | 8.8 | 2026-09-08 | Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-73028 | High | 8.8 | 2026-09-08 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-68786 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-68775 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67639 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67388 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67385 | High | 8.8 | 2026-09-08 | Use after free in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67384 | High | 8.8 | 2026-09-08 | Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67381 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-67380 | High | 8.8 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-67370 | High | 8.8 | 2026-09-08 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |