CVE-2026-70003: JDBC Driver for SQL Server Security Feature Bypass Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is exploitable over a network and does not require prior privileges or user interaction. Exploitation has high attack complexity.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can bypass a security feature and may result in high confidentiality and integrity impact. The availability impact is rated as none.

Q: Which product is identified as affected?

The provided information identifies Microsoft JDBC Driver 13.4 for SQL Server.

Published Nov 10, 2026

Updated

Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.

Other sources

JDBC Driver for SQL Server Security Feature Bypass Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft JDBC Driver 13.4 for SQL Server<13.6.0

13.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.6.0

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is exploitable over a network and does not require prior privileges or user interaction. Exploitation has high attack complexity.

What is the potential impact if exploitation succeeds?

Successful exploitation can bypass a security feature and may result in high confidentiality and integrity impact. The availability impact is rated as none.

Which product is identified as affected?

The provided information identifies Microsoft JDBC Driver 13.4 for SQL Server.

CVE-2026-70003: JDBC Driver for SQL Server Security Feature Bypass Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which product is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which product is identified as affected?