Security Scan: SQL Server CVEs

atlas security scan now matches SQL Server servers against the CVEs published for SQL Server 2008 through 2025.

The cve check of atlas security scan now matches the server version of SQL Server against the CVEs the Security Graph holds for SQL Server 2008 through 2025, as it does for PostgreSQL, MySQL, MariaDB, and ClickHouse since Security Scan: CVEs of the Database Server. The matching runs in the Security Graph, so Atlas v1.3.7 and later report these findings without an upgrade.

A SQL Server 2022 server on CU27:

atlas security scan --url "sqlserver://sa:P@ssw0rd0995@localhost:1433?database=master&mode=database"

Scanning 1 database for security issues:

  -- sqlserver://sa:xxxxx@localhost:1433?database=master&mode=database (sqlserver 16.0.4295.3):
    -- Engine "sqlserver" version "16.0.4295.3" is vulnerable to CVE-2026-32176 (ELEVATED):
       SQL Server Elevation of Privilege Vulnerability. Upgrade database engine "sqlserver" to
       version 16.0.4305.5 or later to resolve CVE-2026-32176

  -------------------------
  -- 1.089923081s
  -- 1 issue found: 1 elevated

16.0.4305.5 is the security update released on top of CU27, and a scan of a server on that build reports no issues found in the server version.

Servicing Branches

SQL Server ships each fix twice: in a build of the GDR branch, which carries security fixes only, and in a build of the cumulative update (CU) branch. A server is matched against the fix of its own branch, so the upgrade it is told to make stays on that branch. For CVE-2026-78456 on SQL Server 2022:

The finding of the CU build suggests Upgrade database engine "sqlserver" to version 16.0.4275.2 or later to resolve CVE-2026-78456.

Azure SQL Database

Azure SQL Database is not checked. It reports version 12.0.2000.8, the RTM build of SQL Server 2014, whatever it runs, so a SQL Server 2014 server still on that build is not reported either.

See Engines and extensions for the engines the scan checks.