CVE-2025-49719

Microsoft SQL Server Information Disclosure Vulnerability

CVSS 7.5 HIGHEPSS 10.2%CWE-20

Vexday Risk Score

26Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 10.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

08 Jul 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Affected products

Microsoft · Microsoft SQL Server 2016 for Service Pack 2 (GDR)Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack Microsoft · Microsoft SQL Server 2017 (CU 31)Microsoft · Microsoft SQL Server 2017 (GDR)Microsoft · Microsoft SQL Server 2019 (CU 32)Microsoft · Microsoft SQL Server 2019 (GDR)Microsoft · Microsoft SQL Server 2022 (CU 19)Microsoft · Microsoft SQL Server 2022 (GDR)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49719