CVE-2026-88086: Microsoft SQL Server Information Disclosure Vulnerability
Microsoft SQL Server Information Disclosure Vulnerability
Other sources
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2200.2Patch KB5128495 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4500.2Patch KB5128494 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be able to reach the SQL Server over an adjacent network. The supplied vector indicates no privileges or user interaction are required, but exploitation has high attack complexity.
Which SQL Server deployments should be reviewed?
Review deployments running Microsoft SQL Server 2019, SQL Server 2022, or SQL Server 2025, including the specifically listed SQL Server 2019 CU32, SQL Server 2022 CU27, SQL Server 2025 CU8, and SQL Server 2025 CU9 releases. The provided data does not identify which configurations or patch levels are unaffected.
What is the expected security impact?
The stated impact is disclosure of information through an out-of-bounds read. The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact.