A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HMicrosoft SQL Server
APPMicrosoft2014Microsoft Sql Server 2016
APPMicrosoft13.0.4001.0 – 13.0.4259.0 (excl.)13.0.4411.0 – 13.0.4604.0 (excl.)13.0.5026.0 – 13.0.5101.9 (excl.)13.0.5149.0 – 13.0.5366.0 (excl.)Microsoft Sql Server 2017
APPMicrosoft14.0.1000.169 – 14.0.2027.2 (excl.)14.0.3006.16 – 14.0.3192.2 (excl.)
CISA KEV — detailsi
- Vendori
- Microsoft ↗
- Producti
- SQL Server
- Added to KEVi
- August 26, 2026
- Remediation deadline (US Federal)i
- August 29, 2026(overdue)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
Related vulnerabilities
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...
Buffer overflow umożliwiający RCE w Microsoft SQL Server
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly ha...
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 ...