Information Disclosure Vulnerability in SQL Server by Microsoft
CVE-2026-88086

5.3MEDIUM

What is CVE-2026-88086?

An information disclosure vulnerability exists in Microsoft SQL Server that allows unauthorized access to sensitive information via an out-of-bounds read. An attacker could exploit this flaw to gain insights into data over an adjacent network, potentially leading to further exploitation or data leakage. It is essential for users to implement the latest security updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Microsoft SQL Server 2019 (GDR) x64-based Systems 15.0.0 < 15.0.2200.2

Microsoft SQL Server 2019 for x64-based Systems (CU32) x64-based Systems 15.0.4003.23 < 15.0.4500.2

Microsoft SQL Server 2022 (GDR) x64-based Systems 16.0.0 < 16.0.1210.3

References

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.