FAIL › dossier
sql server 2019
PRODUCT· dossier confidence 20%
Microsoft SQL Server 2019 is a major enterprise database product from Microsoft, but its security posture has severely degraded with a critical cluster of RCEs, buffer overflows, and deserialization flaws discovered in September 2026. The product requires immediate patching and architectural review to mitigate the risk of remote code execution and data compromise.
PROFILE
CategoryEnterprise DatabaseWhat they doMicrosoft SQL Server 2019 is an enterprise relational database management system developed by Microsoft for Windows and Linux environments.
Websitehttps://www.microsoft.com/sql-server ↗
SECURITY POSTURE
The product has a critical vulnerability cluster in September 2026, with multiple critical RCEs, buffer overflows, and deserialization flaws discovered in a single week, indicating severe systemic issues in the core engine and unpatched components.
Notable failures
- CVE-2026-67636: Critical RCE via out-of-bounds read
- CVE-2026-67631: Critical heap-based buffer overflow
- CVE-2026-67378: Critical untrusted pointer dereference
- CVE-2026-54118: Critical deserialization of untrusted data
- CVE-2026-54117: Critical deserialization of untrusted data
- CVE-2024-37341: High elevation of privilege
Patterns: repeated critical RCEs and buffer overflows in September 2026; systemic deserialization vulnerabilities in core engine; high-severity elevation of privilege flaws in 2024
FAILURE HISTORY · 7
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-09-08 | CVE-2026-67631 | critical | A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network. |
| 2026-09-08 | CVE-2026-67378 | critical | CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server allowing remote code execution over a network. |
| 2026-09-08 | CVE-2026-67636 | critical | An out-of-bounds read vulnerability in SQL Server allows remote code execution over a network. |
| 2026-07-14 | CVE-2026-54118 | critical | CVE-2026-54118: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
| 2026-07-14 | CVE-2026-54117 | critical | CVE-2026-54117: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
| 2024-09-10 | CVE-2024-37341 | high | CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability |
| 2024-09-10 | CVE-2024-37980 | high | CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability |
DOSSIER SOURCES
- Company Database Search · www.edgarcompany.sec.gov
- Microsoft Corporation (MSFT) Company Profile - Business Overview ... · stocknear.com
- Microsoft (MSFT) Company Profile & Description - Stock Analysis · stockanalysis.com
- Microsoft SQL Server releases, versions & end-of-life (EOL) · www.versio.io
- Latest updates and version history for SQL Server on Linux · learn.microsoft.com
- Latest SQL Server Updates & Patches | Builds, KBs, CUs & GDRs · kerteszmihaly.com
Open questions: Exact founding year of SQL Server product line · Precise HQ location for Microsoft SQL Server development
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-18 04:24:44.091367+00:00