FAIL › dossier
sql server 2022
PRODUCT· dossier confidence 20%
Microsoft SQL Server 2022 is a major enterprise database product from Microsoft, but its security posture has severely degraded with a critical cluster of RCEs, buffer overflows, and deserialization flaws discovered in September 2026. The product requires immediate patching and architectural review to mitigate the risk of remote code execution and data compromise.
PROFILE
CategoryDatabase Management SoftwareWhat they doMicrosoft SQL Server 2022 is a relational database management system that provides data storage, query processing, and business intelligence capabilities for enterprise environments.
Websitehttps://www.microsoft.com/sql-server ↗
SECURITY POSTURE
The product has a critical vulnerability cluster in September 2026, with multiple critical RCEs, buffer overflows, and deserialization flaws discovered simultaneously, indicating a severe regression in core memory safety or code review processes.
Notable failures
- CVE-2026-67636: Critical RCE via out-of-bounds read
- CVE-2026-67643: Critical heap-based buffer overflow
- CVE-2026-54117: Critical deserialization of untrusted data
Patterns: Critical vulnerabilities clustered in single release cycles; Recurring heap-based buffer overflows and out-of-bounds reads; Multiple critical RCEs discovered simultaneously
FAILURE HISTORY · 8
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-09-08 | CVE-2026-67643 | critical | A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network. |
| 2026-09-08 | CVE-2026-67631 | critical | A heap-based buffer overflow in Microsoft SQL Server allows remote code execution over a network. |
| 2026-09-08 | CVE-2026-67378 | critical | CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server allowing remote code execution over a network. |
| 2026-09-08 | CVE-2026-67636 | critical | An out-of-bounds read vulnerability in SQL Server allows remote code execution over a network. |
| 2026-07-14 | CVE-2026-54118 | critical | CVE-2026-54118: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
| 2026-07-14 | CVE-2026-54117 | critical | CVE-2026-54117: Deserialization of untrusted data in SQL Server allows an unauthorized attacker |
| 2024-09-10 | CVE-2024-37980 | high | CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability |
| 2024-09-10 | CVE-2024-37341 | high | CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability |
DOSSIER SOURCES
- Microsoft Corporation (MSFT) Company Profile - Business Overview ... · stocknear.com
- MICROSOFT CORP (MSFT, US5949181045) - Company Profile · financialdata.net
- Microsoft Corporation, MSFT:WSE profile - FT.com · markets.ft.com
- Microsoft (MSFT) Company Profile & Description - Stock Analysis · stockanalysis.com
- SQL Server 2022 Updates by Microsoft - September 2026 - Releasebot · releasebot.io
- KB5104824 - Cumulative Update 27 for SQL Server 2022 · support.microsoft.com
- SQL 2025 Standard License - Easy SQL Server Licensing Ad ... · duckduckgo.com
- Microsoft SQL Server releases, versions & end-of-life (EOL) · www.versio.io
- SQL Server 2022 build versions (KB5023451) - SQL Server · learn.microsoft.com
Open questions: exact founding year of SQL Server product line · specific patch cadence for SQL Server 2022
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-18 04:23:16.665697+00:00