CVE-2026-85919: Microsoft SQL Server Elevation of Privilege Vulnerability
Published Oct 13, 2026
·Updated
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft SQL Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
21 affected componentsFixes available
Microsoft SQL Server 2022<16.0.1210.3
16.0.1210.3
Microsoft SQL Server 2025<17.0.1145.4
17.0.1145.4
Microsoft SQL Server 2019<15.0.2200.2
15.0.2200.2
Microsoft SQL Server 2025>=17.0.4006.2<=17.0.5005.3
17.0.5015.4
Microsoft SQL Server 2025>=17.0.1000.7<=17.0.1135.8
17.0.1145.4
Microsoft SQL Server 2022>=16.0.4003.1<=16.0.4295.3
16.0.4305.5
Microsoft SQL Server 2022>=16.0.1000.6<=16.0.1200.5
16.0.1210.3
Microsoft SQL Server 2019>=15.0.4003.23<=15.0.4490.9
15.0.4500.2
Microsoft SQL Server 2019>=15.0.2000.5<=15.0.2190.7
15.0.2200.2
Microsoft SQL Server 2017>=14.0.3006.16<=14.0.3550.4
14.0.3560.2
Microsoft SQL Server 2017>=14.0.1000.169<=14.0.2130.4
14.0.2140.2
Microsoft SQL Server 2025<17.0.5015.4
17.0.5015.4
Microsoft SQL Server 2019<15.0.4500.2
15.0.4500.2
Microsoft SQL Server 2025
Microsoft SQL Server 2022<16.0.4305.5
16.0.4305.5
Microsoft SQL Server 2019>=15.0.2000.5<15.0.2200.2
Microsoft SQL Server 2019>=15.0.4003.23<15.0.4500.2
Microsoft SQL Server 2022>=16.0.1000.6<16.0.1210.3
Microsoft SQL Server 2022>=16.0.4003.1<16.0.4305.5
Microsoft SQL Server 2025>=17.0.1000.7<17.0.1145.4
Microsoft SQL Server 2025>=17.0.4006.2<17.0.5015.4
Remediation
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·08:37 PM
Data Sourced
via MITRE·08:37 PM
DescriptionSeverity
Data Sourced
via NVD·09:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who is exposed to this vulnerability?
Systems running the listed Microsoft SQL Server 2019, 2022, or 2025 products are in scope. Exploitation is local rather than network-based.
2
What access does an attacker need to exploit it?
An attacker must already be authorized and have local access with low-level privileges. No user interaction is required.
3
What is the likely impact if exploitation succeeds?
Successful exploitation can elevate the attacker's privileges. The supplied severity data indicates potential high impact to confidentiality, integrity, and availability.
4
Does the available information identify a workaround or mitigation for systems that cannot be patched immediately?
No workaround, configuration mitigation, or method for determining prior compromise is provided in the available data.