First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-38087

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft SQL Server 2017 (GDR)	>= 14.0.0, < 14.0.2056.2
Microsoft	Microsoft SQL Server 2019 (GDR)	>= 15.0.0, < 15.0.2116.2
Microsoft	Microsoft SQL Server 2016 Service Pack 3 (GDR)	>= 13.0.0, < 13.0.6441.1
Microsoft	Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack	>= 13.0.0, < 13.0.7037.1
Microsoft	Microsoft SQL Server 2017 (CU 31)	>= 14.0.0, < 14.0.3471.2
Microsoft	Microsoft SQL Server 2022 (GDR)	>= 16.0.0, < 16.0.1121.4
Microsoft	Microsoft SQL Server 2019 for x64-based Systems (CU 27)	>= 15.0.0, < 15.0.4382.1
Microsoft	Microsoft SQL Server 2022 for (CU 13)	>= 16.0.0, < 16.0.4131.2

References

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-380888.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-380899.9Microsoft Defender for IoT Elevation of Privilege Vulnerability CVE-2024-38098.8The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via t CVE-2024-380917.5Microsoft WS-Discovery Denial of Service Vulnerability CVE-2024-380928.8Azure CycleCloud Elevation of Privilege Vulnerability CVE-2024-380934.3Microsoft Edge (Chromium-based) Spoofing Vulnerability CVE-2024-380947.2Microsoft SharePoint Remote Code Execution Vulnerability CVE-2024-380957.5.NET and Visual Studio Denial of Service Vulnerability CVE-2024-380977.1Azure Monitor Agent Elevation of Privilege Vulnerability CVE-2024-380987.8Azure Connected Machine Agent Elevation of Privilege Vulnerability CVE-2024-380995.9Windows Remote Desktop Licensing Service Denial of Service Vulnerability CVE-2024-38108.8The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.3 via the 'icon'

CVE-2024-38087: High severity, CVSS 8.8 | Vulnix