Microsoft SQL Server Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/08/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| sql server | = 2014 | |
| sql server 2016 | ≥ 13.0.4001.0, < 13.0.4259.0≥ 13.0.4411.0, < 13.0.4604.0≥ 13.0.5026.0, < 13.0.5101.9≥ 13.0.5149.0, < 13.0.5366.0 | 13.0.4259.013.0.4604.013.0.5101.913.0.5366.0 |
| sql server 2017 | ≥ 14.0.1000.169, < 14.0.2027.2≥ 14.0.3006.16, < 14.0.3192.2 | 14.0.2027.214.0.3192.2 |
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free