High 7.7Published Oct 13, 2026

CVE-2026-88081Microsoft SQL Server Information Disclosure Vulnerability

Updated under an hour ago (Oct 28, 2026, 10:23 AM ET)

Does this affect you?

It affects Microsoft SQL Server 2017 (GDR) and 8 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.80%, higher than 56% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Microsoft SQL Server 2017 (GDR)

Exploited in the last 30 days

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.80% (percentile 56)
Assigned by: microsoft
NVD analysis: Awaiting Analysis
Record last updated: Oct 27, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

Microsoft Microsoft SQL Server 2017 (GDR) microsoft:sql_server_2017_gdr (from the name)	from 14.0.0 before 14.0.2140.2	CNA record
Microsoft Microsoft SQL Server 2017 for x64-based Systems (CU31) microsoft:sql_server_2017_for_x64_based_systems_cu31 (from the name)	from 14.0.3006.16 before 14.0.3560.2	CNA record
Microsoft Microsoft SQL Server 2019 (GDR) microsoft:sql_server_2019_gdr (from the name)	from 15.0.0 before 15.0.2200.2	CNA record
Microsoft Microsoft SQL Server 2019 for x64-based Systems (CU32) microsoft:sql_server_2019_for_x64_based_systems_cu32 (from the name)	from 15.0.4003.23 before 15.0.4500.2	CNA record
Microsoft Microsoft SQL Server 2022 (GDR) microsoft:sql_server_2022_gdr (from the name)	from 16.0.0 before 16.0.1210.3	CNA record
Microsoft Microsoft SQL Server 2022 for x64-based Systems (CU27) microsoft:sql_server_2022_for_x64_based_systems_cu27 (from the name)	from 16.0.4003.1 before 16.0.4305.5	CNA record
Microsoft Microsoft SQL Server 2025 (CU8) microsoft:sql_server_2025_cu8 (from the name)	-	CNA record
Microsoft Microsoft SQL Server 2025 for x64-based Systems (CU9) microsoft:sql_server_2025_for_x64_based_systems_cu9 (from the name)	from 17.0.4006.2 before 17.0.5015.4	CNA record
Microsoft Microsoft SQL Server 2025 for x64-based Systems (GDR) microsoft:sql_server_2025_for_x64_based_systems_gdr (from the name)	from 17.0.1050.2 before 17.0.1145.4	CNA record

References

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88081	vendor-advisory, patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.