CVE-2026-33120

Microsoft SQL Server Remote Code Execution Vulnerability

Published Apr 14, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

Analysis

Technical impact

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network, resulting in full remote code execution. The flaw corresponds to CWE‑822, indicating that a bad pointer is dereferenced without proper validation, enabling an attacker to run arbitrary code with the privileges of the SQL Server service.

Affected Systems

Microsoft SQL Server 2022 GDR is affected. No other product versions are explicitly listed.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. Exploit probability information is not available, and the vulnerability is not present in the CISA KEV catalog. Attackers likely require authorized network access to the SQL Server instance; an authenticated user could leverage this flaw to gain code execution rights over the network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft SQL Server 2022 (GDR)

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.1175.1

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:sql_server_2016:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2016:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*
	cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*

No data.

Vendor Product Versions

Microsoft

Sql Server 2022

Version	Status	Scheme	Platform
`[16.0.0,16.0.1175.1)`	affected	generic	['x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft SQL Server 2022 GDR security update identified in the Microsoft Security Update Guide for CVE-2026-33120.
Verify that the patch has been installed by checking the SQL Server version and confirming the hotfix application.
Until the patch is applied, restrict network access to the SQL Server and enforce least‑privilege for database users.
Enable audit logging and review logs for suspicious or unauthorized connection attempts.

Generated by OpenCVE AI on April 14, 2026 at 19:54 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.718% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120

History

May 6, 2026 1:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft sql Server 2016 Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2025
CPEs		cpe:2.3:a:microsoft:sql_server_2016:::::::x64:* cpe:2.3:a:microsoft:sql_server_2017:::::::x64:* cpe:2.3:a:microsoft:sql_server_2019:::::::x64:* cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*
Vendors & Products		Microsoft sql Server 2016 Microsoft sql Server 2017 Microsoft sql Server 2019 Microsoft sql Server 2025

Apr 14, 2026 8:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 14, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
Title		Microsoft SQL Server Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft sql Server 2022
Weaknesses		CWE-822
CPEs		cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*
Vendors & Products		Microsoft Microsoft sql Server 2022
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`