What’s Vulnerable › Vulnerabilities

CVE-2022-29143: Microsoft SQL Server Remote Code Execution Vulnerability

• Severity: medium (CVSS 6.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-15 · updated 2026-06-17

Description

Microsoft SQL Server Remote Code Execution Vulnerability

Affected products

• Microsoft SQL Server: 2014-sp3, 2016-sp2, 2016-sp3, 2017, 2019
• Microsoft SQL Server 2014 Service Pack 3 (CU 4): from 12.0.0 before 12.0.6439.10 — fixed in 12.0.6439.10
• Microsoft SQL Server 2014 Service Pack 3 (GDR): from 12.0.0 before 12.0.6169.19 — fixed in 12.0.6169.19
• Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR): from 13.0.0 before 13.0.5108.50 — fixed in 13.0.5108.50
• Microsoft SQL Server 2016 Service Pack 2 (CU 17): from 13.0.0.0 before 13.0.5893.48 — fixed in 13.0.5893.48
• Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack: from 13.0.0 before 13.0.7016.1 — fixed in 13.0.7016.1
• Microsoft SQL Server 2016 Service Pack 3 (GDR): from 13.0.0 before 13.0.6419.1 — fixed in 13.0.6419.1
• Microsoft SQL Server 2017 (CU 29): from 14.0.0.0 before 14.0.3445.2 — fixed in 14.0.3445.2
• Microsoft SQL Server 2017 (GDR): from 14.0.0 before 14.0.2042.3 — fixed in 14.0.2042.3
• Microsoft SQL Server 2019 (CU 16): from 15.0.0.0 before 15.0.4236.7 — fixed in 15.0.4236.7
• Microsoft SQL Server 2019 (GDR): from 15.0.0 before 15.0.2095.3 — fixed in 15.0.2095.3

How to fix

Upgrade to a fixed version: Microsoft SQL Server 2014 Service Pack 3 (CU 4) 12.0.6439.10; Microsoft SQL Server 2014 Service Pack 3 (GDR) 12.0.6169.19; Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) 13.0.5108.50; Microsoft SQL Server 2016 Service Pack 2 (CU 17) 13.0.5893.48; Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack 13.0.7016.1; Microsoft SQL Server 2016 Service Pack 3 (GDR) 13.0.6419.1; Microsoft SQL Server 2017 (CU 29) 14.0.3445.2; Microsoft SQL Server 2017 (GDR) 14.0.2042.3; Microsoft SQL Server 2019 (CU 16) 15.0.4236.7; Microsoft SQL Server 2019 (GDR) 15.0.2095.3. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29143

Get alerted when CVE-2022-29143 or the next vulnerability affects your stack