Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122771, KB5122770, KB5122768 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft SQL Server 2022 for x64-based Systems (GDR) (+2 more)Fix KB5122771, KB5122770, KB5122768 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122771, KB5122770, KB5122768 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122773, KB5122771, KB5122770 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR) (+4 more)Fix KB5122773, KB5122771, KB5122770 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122773, KB5122771, KB5122770 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.0
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122769, KB5122768, KB5122775 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2017 for x64-based Systems (CU 31), Microsoft SQL Server 2017 for x64-based Systems (GDR) (+6 more)Fix KB5122769, KB5122768, KB5122775 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122769, KB5122768, KB5122775 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122773, KB5122771, KB5122770 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR) (+4 more)Fix KB5122773, KB5122771, KB5122770 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122773, KB5122771, KB5122770 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.0
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects SQL Server Management Studio 22Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 9.6
Type
Security updates
Tags
SQL Server, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Defender Elevation of Privilege Vulnerability. Microsoft rates it Important; not reported as exploited; publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity ImportantExploited NoDisclosed YesAffects Microsoft Malware Protection EngineFix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports it as publicly disclosed, so it matters if you run the affected products.
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
Severity
Important · CVSS 7.8
Type
Security updates
Services
Defender
Tags
Microsoft Defender, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: Yes · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.