CVE-20XX-?

Microsoft Sql Server 2016 CVEs.

Published CVEs affecting Microsoft Sql Server 2016, ranked by exploit odds.

20 CVEs · updated 2026-11-06 05:56 UTC

Reset all
  1. CVE-2025-49719

    Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

    Disclosure Server Microsoft Sql Server 2016

    7.5 HIGH 15% exploit odds Fix listed
  2. CVE-2025-24999

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Sql Server 2016

    8.8 HIGH 2% exploit odds Fix listed
  3. CVE-2026-21262

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Sql Server 2016

    8.8 HIGH 2% exploit odds Fix listed
  4. CVE-2026-54117

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

    Code execution Server Microsoft Sql Server 2016

    9.8 CRITICAL 2% exploit odds Fix listed
  5. CVE-2026-54118

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

    Code execution Server Microsoft Sql Server 2016

    9.8 CRITICAL 2% exploit odds Fix listed
  6. CVE-2025-55227

    Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  7. CVE-2025-53727

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  8. CVE-2026-26115

    Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  9. CVE-2025-49759

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  10. CVE-2026-26116

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  11. CVE-2025-59499

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  12. CVE-2025-49758

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Sql Server 2016

    8.8 HIGH 1% exploit odds Fix listed
  13. CVE-2026-47295

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    8.8 HIGH 1.0% exploit odds Fix listed
  14. CVE-2026-55002

    External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Sql Server 2016

    8.8 HIGH 0.9% exploit odds Fix listed
  15. CVE-2025-47997

    Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

    Disclosure Server Microsoft Sql Server 2016

    6.5 MEDIUM 0.9% exploit odds Fix listed
  16. CVE-2026-33120

    Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

    Code execution Server Microsoft Sql Server 2016

    8.8 HIGH 0.7% exploit odds Fix listed
  17. CVE-2026-47296

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

    Injection Server Microsoft Sql Server 2016

    7.5 HIGH 0.7% exploit odds Fix listed
  18. CVE-2026-40370

    External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

    Other Server Microsoft Sql Server 2016

    8.8 HIGH 0.6% exploit odds Fix listed
  19. CVE-2026-32167

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

    Injection Server Microsoft Sql Server 2016

    6.7 MEDIUM 0.3% exploit odds Fix listed
  20. CVE-2026-32176

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.

    Injection Server Microsoft Sql Server 2016

    6.7 MEDIUM 0.2% exploit odds Fix listed

All CVEs affecting Microsoft Sql Server 2016 that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.