Skip to main content

Sql Server 2016 CVE-2024-37980

CRITICAL
Improper Privilege Management (CWE-269)
2024-09-10 secure@microsoft.com
Privilege Escalation Microsoft Sql Server 2016 Sql Server 2017 Sql Server 2019 Sql Server 2022
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 10, 2024 - 17:15 nvd
CRITICAL 9.8

DescriptionNVD

Microsoft SQL Server Elevation of Privilege Vulnerability

AnalysisAI

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Affected products include: Microsoft Sql Server 2016, Microsoft Sql Server 2017, Microsoft Sql Server 2019, Microsoft Sql Server 2022.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.

More in Sql Server 2016

View all
CVE-2026-21262 HIGH POC
8.8 Mar 10

SQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
CVE-2024-37341 CRITICAL
9.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is rem
CVE-2024-37965 HIGH
8.8 Sep 10

Microsoft SQL Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotel
CVE-2024-37340 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37339 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37338 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-37335 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-26191 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2024-26186 HIGH
8.8 Sep 10

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerabil
CVE-2025-49759 HIGH
8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-49758 HIGH
8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

CVE-2025-53727 HIGH
8.8 Aug 12

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2024-37980 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy