CVE-2026-94520: Microsoft SQL Server Denial of Service Vulnerability
Microsoft SQL Server Denial of Service Vulnerability
Other sources
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3560.2Patch KB5128496 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4500.2Patch KB5128494 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2200.2Patch KB5128495 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2140.2Patch KB5128497
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized to access the affected SQL Server and able to reach it over the network. The supplied data does not indicate that unauthenticated attackers can exploit it.
What is the likely impact of successful exploitation?
Successful exploitation can deny service on SQL Server. The provided CVSS vector indicates no confidentiality or integrity impact, with availability as the affected security property.
Does exploitation require user interaction or complex attack conditions?
The CVSS vector indicates no user interaction is required and attack complexity is low. However, the attacker needs high privileges.