What is the CVSS score of EUVD-2026-22637?

EUVD-2026-22637 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Sql Server 2022 Gdr are affected by EUVD-2026-22637?

Microsoft SQL Server 2022 (GDR) contains a remote code execution vulnerability (CVE-2026-33120) affecting versions below 16.0.1175.1 that allows authenticated users with low-level database access to…. A patch is available.

How to fix or mitigate EUVD-2026-22637?

Within 24 hours: Identify all SQL Server 2022 (GDR) instances below version 16.0.1175.1 in production and non-production environments using asset management or vulnerability scanning tools. Within 7 days: Apply vendor patch to version 16.0.1175.1 or later on development/test systems first to validate application compatibility. Within 30 days: Complete patching of all production SQL Server 2022 (GDR) systems, prioritizing those handling sensitive data or supporting critical business functions.

Microsoft Sql Server 2022 Gdr EUVD-2026-22637

| CVE-2026-33120 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-04-14 microsoft

Information Disclosure Microsoft Sql Server 2022 Gdr

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:24 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22637

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 8.8

DescriptionCVE.org

Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft SQL Server 2022 (GDR) allows authenticated network attackers to execute arbitrary code with high confidentiality, integrity, and availability impact via untrusted pointer dereference. The vulnerability affects SQL Server 2022 (GDR) versions below 16.0.1175.1, requires low-privilege authenticated access (PR:L), and has low attack complexity (AC:L), making it straightforward to exploit once network access is obtained. Vendor-released patch available (version 16.0.1175.1). No public exploit identified at time of analysis, though the network attack vector and low complexity suggest moderate near-term exploitation risk.

Technical ContextAI

This vulnerability stems from CWE-822 (Untrusted Pointer Dereference), where Microsoft SQL Server 2022 (GDR branch) improperly handles pointer operations when processing network requests from authenticated users. The affected component (cpe:2.3:a:microsoft:microsoft_sql_server_2022_(gdr)) fails to validate pointer sources or destinations, allowing an attacker to manipulate memory references and redirect code execution flow. SQL Server's GDR (General Distribution Release) update channel provides critical security fixes without feature changes, making this a targeted attack against organizations using the GDR servicing model. The network attack vector (AV:N) indicates the vulnerability can be triggered through SQL Server's standard network protocols (TDS protocol on TCP 1433 or configured ports) without requiring local system access. The untrusted pointer dereference class represents a memory corruption vulnerability where malicious input causes the application to use attacker-controlled data as a memory address, bypassing standard control flow protections.

RemediationAI

Apply the vendor-released patch by upgrading Microsoft SQL Server 2022 (GDR) to version 16.0.1175.1 or later, available through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120. Standard SQL Server patching procedures apply: review the update guide for installation prerequisites, test in non-production environments, schedule maintenance windows to minimize service disruption, and verify successful installation through version queries (SELECT @@VERSION). For environments unable to immediately patch, implement defense-in-depth controls: restrict network access to SQL Server instances using firewall rules limiting connections to trusted IP ranges, enforce strong authentication policies with complex passwords or certificate-based authentication, disable unused SQL Server features and protocols, apply principle of least privilege to database account permissions, and enhance monitoring for unusual authenticated connection patterns or memory corruption indicators. Network segmentation can reduce attack surface by isolating SQL Server instances from untrusted network zones.