CVE-2023-36417: Microsoft SQL OLE DB Remote Code Execution Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-10 · updated 2026-06-17
Weakness: CWE-122

Description

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Affected products

Microsoft Ole Db Driver For Sql Server: from 18.0.0 before 18.6.0007.0; from 19.0.0 before 19.3.0002.0 — fixed in 18.6.0007.0, 19.3.0002.0
Microsoft SQL Server: 2019, 2022
Microsoft OLE DB Driver 18 for SQL Server: from 18.0.0 before 18.6.0007.0 — fixed in 18.6.0007.0
Microsoft OLE DB Driver 19 for SQL Server: from 19.0.0 before 19.3.0002.0 — fixed in 19.3.0002.0
Microsoft SQL Server 2019 (CU 22): from 15.0.0 before 15.0.4326.1 — fixed in 15.0.4326.1
Microsoft SQL Server 2019 (GDR): from 15.0.0 before 15.0.2104.1 — fixed in 15.0.2104.1
Microsoft SQL Server 2022 (CU 8): from 15.0.0 before 16.0.4080.1 — fixed in 16.0.4080.1
Microsoft SQL Server 2022 (GDR): from 16.0.0 before 16.0.1105.1 — fixed in 16.0.1105.1

How to fix

Upgrade to a fixed version: Microsoft Ole Db Driver For Sql Server 18.6.0007.0, 19.3.0002.0; Microsoft OLE DB Driver 18 for SQL Server 18.6.0007.0; Microsoft OLE DB Driver 19 for SQL Server 19.3.0002.0; Microsoft SQL Server 2019 (CU 22) 15.0.4326.1; Microsoft SQL Server 2019 (GDR) 15.0.2104.1; Microsoft SQL Server 2022 (CU 8) 16.0.4080.1; Microsoft SQL Server 2022 (GDR) 16.0.1105.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36417 or the next vulnerability affects your stack