CVE-2026-62903: Microsoft.Data.SqlClient Information Disclosure Vulnerability

Q: What must an attacker be able to do to exploit this issue?

The attack is network-based and uses capture-replay to bypass authentication. No attacker privileges or user interaction are required, but the high attack-complexity rating indicates exploitation has additional conditions not specified in the available data.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information and has high confidentiality impact. The supplied severity vector also rates integrity impact as high, while availability impact is rated as none.

Q: Which products should be included in triage?

Triage Microsoft.Data.SqlClient and Microsoft SQL Server 2017, 2019, 2022, and 2025. The available information does not identify affected build numbers, configurations, or fixed versions.

Published Nov 10, 2026

Updated

Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.

Other sources

Microsoft.Data.SqlClient Information Disclosure Vulnerability

— Microsoft

Affected Software

11 affected componentsFixes available

Microsoft Microsoft.Data.SqlClient>=7.0<7.0.3

7.0.3

Microsoft Microsoft.Data.SqlClient>=6.1<6.1.7

6.1.7

Microsoft Microsoft.Data.SqlClient>=7.1<7.1.0-preview3

7.1.0-preview3

Microsoft SQL Server 2025>=17.0.4006.2<=17.0.5035.5

17.0.5045.3

Microsoft SQL Server 2025>=17.0.1000.7<=17.0.1145.4

17.0.1155.3

Microsoft SQL Server 2022>=16.0.4003.1<=16.0.4305.5

16.0.4315.2

Microsoft SQL Server 2022>=16.0.1000.6<=16.0.1210.3

16.0.1220.3

Microsoft SQL Server 2019>=15.0.4003.23<=15.0.4500.2

15.0.4510.2

Microsoft SQL Server 2019>=15.0.2000.5<=15.0.2200.2

15.0.2210.4

Microsoft SQL Server 2017>=14.0.3006.16<=14.0.3560.2

14.0.3570.2

Microsoft SQL Server 2017>=14.0.1000.169<=14.0.2140.2

14.0.2150.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.3
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.0-preview3
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5045.3Patch KB5129299
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1155.3Patch KB5132748
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4315.2Patch KB5129300
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1220.3Patch KB5132747
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4510.2Patch KB5132745
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2210.4Patch KB5132751
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3570.2Patch KB5132746
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2150.2Patch KB5132749

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attack is network-based and uses capture-replay to bypass authentication. No attacker privileges or user interaction are required, but the high attack-complexity rating indicates exploitation has additional conditions not specified in the available data.

What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information and has high confidentiality impact. The supplied severity vector also rates integrity impact as high, while availability impact is rated as none.

Which products should be included in triage?

Triage Microsoft.Data.SqlClient and Microsoft SQL Server 2017, 2019, 2022, and 2025. The available information does not identify affected build numbers, configurations, or fixed versions.

CVE-2026-62903: Microsoft.Data.SqlClient Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the expected impact if exploitation succeeds?

Which products should be included in triage?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

What is the expected impact if exploitation succeeds?

Which products should be included in triage?