{"id":"CVE-2021-1636","title":"Microsoft SQL Elevation of Privilege Vulnerability","summary":"Microsoft SQL Elevation of Privilege Vulnerability","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","cvssSource":"cna","vendor":"Microsoft","product":"Microsoft SQL Server 2012 Service Pack 4 (QFE)","affected":["sql_server_2012_service_pack_4_qfe >= 11.0.0 < publication","sql_server_2012_for_x64-based_systems_service_pack_4_qfe >= 11.0.0 < publication","sql_server_2017_gdr >= 14.0.0 < publication","sql_server_2014_service_pack_3_gdr >= 12.0.0 < publication","sql_server_2016_for_x64-based_systems_service_pack_2_gdr >= 13.0.0 < publication","sql_server_2014_service_pack_3_cu_4 >= 12.0.0 < publication","sql_server_2017_cu_22 >= 14.0.0 < publication","sql_server_2016_service_pack_2_cu_15 >= 13.0.0 < publication","sql_server_2019_cu_8 >= 16.0.0 < publication","sql_server_2019_gdr >= 15.0.0 < publication"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-02T17:58:38.273449Z"},"exploitAvailable":true,"published":"2021-01-12","updated":"2026-11-02","sourceUpdated":"2026-11-02T17:58:49.530Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-1636","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1636","label":"Microsoft SQL Elevation of Privilege Vulnerability"}],"tags":["cve.org","exploit-available"],"epss":0.06693,"epssPercentile":0.93931,"exploits":{"github":1,"githubRepos":["https://github.com/Nate0634034090/bug-free-memory"],"checkedAt":"2026-11-05T19:31:18.368Z"},"ingestedAt":"2026-11-05T19:30:42.761Z","slug":"CVE-2021-1636","body":"## Overview\n\nMicrosoft SQL Elevation of Privilege Vulnerability\n\n## Affected\n\n- `sql_server_2012_service_pack_4_qfe >= 11.0.0 < publication`\n- `sql_server_2012_for_x64-based_systems_service_pack_4_qfe >= 11.0.0 < publication`\n- `sql_server_2017_gdr >= 14.0.0 < publication`\n- `sql_server_2014_service_pack_3_gdr >= 12.0.0 < publication`\n- `sql_server_2016_for_x64-based_systems_service_pack_2_gdr >= 13.0.0 < publication`\n- `sql_server_2014_service_pack_3_cu_4 >= 12.0.0 < publication`\n- `sql_server_2017_cu_22 >= 14.0.0 < publication`\n- `sql_server_2016_service_pack_2_cu_15 >= 13.0.0 < publication`\n- `sql_server_2019_cu_8 >= 16.0.0 < publication`\n- `sql_server_2019_gdr >= 15.0.0 < publication`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":62,"depthScoreParts":{"impact":48.4,"likelihood":1.3,"exploitation":12,"ransomware":0},"changes":[]}