CVE-2026-88083: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
Other sources
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967
Event History
Frequently Asked Questions
Does exploitation require an authenticated SQL Server account or local access?
No authentication or local access is required according to the supplied CVSS vector. The attack vector is network-based, although exploitation has high attack complexity and requires user interaction.
Which SQL Server releases are identified as affected?
The affected software list includes Microsoft SQL Server, SQL Server 2022 including CU 26 and CU27, and SQL Server 2025 including CU8 and CU9.