CVE-2024-28906

HIGH 8.8CVE-2024-28906 · Published 09/04/2024 · updated 17/06/2026

In short

CVE-2024-28906 is a HIGH (CVSS 8.8) vulnerability affecting ole db driver for sql server (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.1% of all vulnerabilities.
Fix: update to 18.7.0002.0, 19.3.0003.0, 15.0.2110.4, 15.0.4360.2 or later.

Package	Affected versions	Patched versions
ole db driver for sql server microsoft	`≥ 18.0.2, < 18.7.0002.0≥ 19.0.0, < 19.3.0003.0`	`18.7.0002.019.3.0003.0`
sql server 2019 microsoft	`≥ 15.0.2000.5, < 15.0.2110.4≥ 15.0.4003.23, < 15.0.4360.2`	`15.0.2110.415.0.4360.2`
sql server 2022 microsoft	`≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.1`	`16.0.1115.116.0.4120.1`

Description

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28906 · Vendor Advisory

More vulnerabilities in ole db driver for sql server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2024-28906 is a HIGH (CVSS 8.8) vulnerability affecting ole db driver for sql server (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.1% of all vulnerabilities.

Fix: update to 18.7.0002.0, 19.3.0003.0, 15.0.2110.4, 15.0.4360.2 or later.

Package

Affected versions

Patched versions

ole db driver for sql server

microsoft

≥ 18.0.2, < 18.7.0002.0≥ 19.0.0, < 19.3.0003.0

18.7.0002.019.3.0003.0

sql server 2019

microsoft

≥ 15.0.2000.5, < 15.0.2110.4≥ 15.0.4003.23, < 15.0.4360.2

15.0.2110.415.0.4360.2

sql server 2022

microsoft

≥ 16.0.1000.6, < 16.0.1115.1≥ 16.0.4003.1, < 16.0.4120.1

16.0.1115.116.0.4120.1

More vulnerabilities in ole db driver for sql server

See all →