CVE-2024-35271

HIGH 8.8CVE-2024-35271 · Published 09/07/2024 · updated 17/06/2026

In short

CVE-2024-35271 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2016 (microsoft), sql server 2017 (microsoft), sql server 2019 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.2% of all vulnerabilities.
Fix: update to 13.0.7037.1, 13.0.6441.1, 14.0.3471.2, 14.0.2056.2 or later.

SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2024-35271 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2016 (microsoft), sql server 2017 (microsoft), sql server 2019 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.2% of all vulnerabilities.

Fix: update to 13.0.7037.1, 13.0.6441.1, 14.0.3471.2, 14.0.2056.2 or later.

Package

Affected versions

Patched versions

≥ 13.0.7000.253, < 13.0.7037.1< 13.0.6441.1

13.0.7037.113.0.6441.1

≥ 14.0.3456.2, < 14.0.3471.2< 14.0.2056.2

14.0.3471.214.0.2056.2

≥ 15.0.4375.4, < 15.0.4382.1< 15.0.2116.2

15.0.4382.115.0.2116.2

≥ 16.0.4125.3, < 16.0.4131.2< 16.0.1121.4

16.0.4131.216.0.1121.4

More vulnerabilities in sql server 2016

See all →