Security vulnerabilities in Redgate products

This page details previously-announced security vulnerabilities in Redgate's products. Our Product Security Policy details how we announce vulnerabilities.

2026

• PHP CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"): no Redgate products contain PHP, and there is no action customers need to take to keep their Redgate product installations secure. Redgate has assessed and completed patching its own business infrastructure with the required updates.
• eMudhra compromised TLS certificates: Redgate has assessed its products and services to mitigate the impact of the weak private keys used in several eMudhra TLS certificates. Most products use operating system-managed trust stores; if you use container images of our products, updated versions are now available. Details

2025

• CVE-2025-55182 ("React2Shell") did not affect any of Redgate's products.Details

• Redgate Monitor prior to 14.0.50 contains a vulnerability that allows non-administrator users to view and access all alerts, ignoring the established access controls. Details

2024

• Redgate Monitor prior to version 14.0.8 is susceptable to CVE-2024-35255, allowing an attacker with local access to the system hosting the Redgate Monitor Base Monitor to read any file on the file system with SYSTEM access permissions. Details

2023

• SQL Monitor versions 12.0.0 to 13.0.21 (inclusive) contain a vulnerability that can result in a Denial of Service attack against its Web Service when hosted using SQL Monitor's built-in web server (CVE-2023-38180). Details

• SQL Monitor prior to version 12.1.54 contains vulnerabilities allowing low-privileged users to perform actions their permissions should not allow, and when using Active Directory (LDAP) authentication, allows low-privileged users to elevate their permissions to a SQL Monitor administrator role (CVE-2022-47542). Details

2021

• CVE-2021-44228 (log4j's "log4shell" vulnerability) did not affect any of Redgate's products. Details

• SQL Monitor versions 9.0.4 to 11.0.18 (inclusive) contain an issue when using Active Directory authorization, whereby some non-administrator users could potentially view servers they were not entitled to according to SQL Monitor's access control settings. Details

2020

• SQL Monitor versions 7.1.4 to 10.1.5 (inclusive) do not correctly check TLS certificate validity for webhook, email, or Slack alerts when it is disabled for a particular scope, or where VMWare servers are monitored. Details
• SQL Monitor versions 9.0.13 to 9.2.14 (inclusive) have a security vulnerability where a user who is an administrator of the SQL Monitor installation is able to perform a SQL injection attack. Details

2019

• SQL Monitor prior to 9.2.5 allowed users with administrative privleges to retrieve configured SMTP server credentials. Details

2018

• SQL Monitor prior to 8.0.19 was vulnerable to a cross-site scripting attack. Details
• SmartAssembly prior to 6.12.5 was vulnerable to untrusted code execution. Details
• .NET Reflector prior to 10.0.7.774 was vulnerable to untrusted code execution. Details

2015

• SQL Monitor prior to 4.2, or SQL Monitor 3 prior to 3.10, were vulnerable to an authentication bypass and SQL command execution. Details

2013

• SQL Backup versions 7.4 and 7.5 insecurely stored credentials for the SQL Backup Agent service. Details