CVE-2024-49000

HIGH 8.8CVE-2024-49000 · Published 12/11/2024 · updated 17/06/2026

In short

CVE-2024-49000 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2016 (microsoft), sql server 2017 (microsoft), sql server 2019 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.7% of all vulnerabilities.
Fix: update to 13.0.6455.2, 13.0.7050.2, 14.0.2070.1, 14.0.3485.1 or later.

SQL Server Native Client Remote Code Execution Vulnerability

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2024-49000 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2016 (microsoft), sql server 2017 (microsoft), sql server 2019 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.7% of all vulnerabilities.

Fix: update to 13.0.6455.2, 13.0.7050.2, 14.0.2070.1, 14.0.3485.1 or later.

Package

Affected versions

Patched versions

≥ 13.0.6300.2, < 13.0.6455.2≥ 13.0.7000.253, < 13.0.7050.2

13.0.6455.213.0.7050.2

≥ 14.0.1000.169, < 14.0.2070.1≥ 14.0.3006.16, < 14.0.3485.1

14.0.2070.114.0.3485.1

≥ 15.0.2000.5, < 15.0.2130.3≥ 15.0.4003.23, < 15.0.4410.1

15.0.2130.315.0.4410.1

More vulnerabilities in sql server 2016

See all →