Review reviewHigh

CVE-2026-33120

Microsoft Microsoft SQL Server 2022 (GDR), sql server 2016, sql server 2017

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.71%

Technical severityCVSS 8.8

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Product: Microsoft Microsoft SQL Server 2022 (GDR), sql server 2016, sql server 2017
Affected versions: >= 16.0.0 < 16.0.1175.1, >= 13.0.6300.2 < 13.0.6485.1, >= 13.0.7000.253 < 13.0.7080.1, >= 14.0.1000.169 < 14.0.2105.1, >= 14.0.3006.16 < 14.0.3525.1, >= 15.0.2000.5 < 15.0.2165.1, >= 15.0.4003.23 < 15.0.4465.1, >= 16.0.1000.6 < 16.0.1175.1, >= 16.0.4003.1 < 16.0.4250.1, >= 17.0.1000.7 < 17.0.1110.1, >= 17.0.4006.2 < 17.0.4030.1
Fixed versions: 13.0.6485.1, 13.0.7080.1, 14.0.2105.1, 14.0.3525.1, 15.0.2165.1, 15.0.4465.1, 16.0.1175.1, 16.0.4250.1, 17.0.1110.1, 17.0.4030.1

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Microsoft Microsoft SQL Server 2022 (GDR), sql server 2016, sql server 2017 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.