CVE-2025-49719

—

CVSS 3.1

7.5 high

EPSS

11%p96

Published

Jul 8, 2025 (Jul 8, 2025)

Modified

Jun 17, 2026

Description

Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.

Vendors: microsoft
Products: sql server 2016, sql server 2017, sql server 2019, sql server 2022
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (10.7%)

In the news7 stories

Microsoft fixes critical wormable Windows flaw (CVE-2025-47981)

Help Net SecurityJul 22, 13:36 UTC · Jul 22, 2025Vulnerability in the wildCVE-2025-47981 CVE-2025-49719 CVE-2025-49717+2 CVEs1

60

Week in review: Microsoft fixes wormable RCE bug on Windows, check for CitrixBleed 2 exploitation

Help Net SecurityJul 13, 00:00 UTC · Jul 13, 2025Vulnerability in the wildCVE-2025-47981 CVE-2025-49719 CVE-2025-5777

60

Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server

The Hacker NewsJul 10, 07:02 UTC · Jul 10, 2025Vulnerability in the wildCVE-2025-49719 CVE-2025-47981 CVE-2025-49735+9 CVEs

60

Microsoft Patch Tuesday addresses 130 vulnerabilities, none actively exploited

CyberScoopJul 9, 16:02 UTC · Jul 9, 2025Vulnerability in the wildCVE-2025-49719 CVE-2025-47981

60

Microsoft Patch Tuesday: One Zero

Infosecurity MagazineJul 9, 13:15 UTC · Jul 9, 2025Vulnerability CVE-2025-47981 CVE-2022-37958 CVE-2025-21295+1 CVEs

60

Microsoft Patch Tuesday, July 2025 Edition

Krebs on SecurityJul 9, 01:47 UTC · Jul 9, 2025Vulnerability in the wildCVE-2025-49719 CVE-2025-47981 CVE-2025-49695+5 CVEs

60

Microsoft Patch Tuesday security updates for July 2025 fixed a zero

Security AffairsJul 8, 21:00 UTC · Jul 8, 2025Vulnerability in the wildCVE-2025-49719 CVE-2025-47981 CVE-2025-49695

60