Microsoft patches 55 SQL Server flaws
NCSC-NL advisory: Microsoft fixed 55 vulnerabilities in SQL Server, its JDBC driver and Azure Kubernetes Service, including a critical 9.8 heap overflow enabling remote code execution.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL (Netherlands' national CSIRT) published an advisory summarizing Microsoft's patches for 55 vulnerabilities across SQL Server, the JDBC Driver for SQL Server, and Azure Kubernetes Service. The flaws span a wide range of weakness classes including heap- and stack-based buffer overflows, SQL and command injection, privilege escalation, authentication bypass via replay, cryptographic signature verification issues, and use of broken cryptographic algorithms. Most vulnerabilities result in either arbitrary code execution or privilege escalation, with several also enabling sensitive data disclosure.
The most severe issue, CVE-2026-116945 (CVSS 9.8), is a heap-based buffer overflow in SQL Server: an unauthenticated attacker who controls a network endpoint that a vulnerable integration package connects to can return a specially crafted response, leading to arbitrary code execution with the privileges of the integration service. Numerous other CVEs (e.g., 116930, 116934, 116941, 116942, 118105, 118109, 118110, 118120, 67374, 67387, 67391, 67632, 67637, 94511) carry CVSS scores of 8.0-8.8 and similarly allow code execution or elevation of privilege. A separate flaw in the JDBC Driver for SQL Server (CVE-2026-70003, CVSS 8.7) allows a security control bypass, and an Azure Kubernetes Service flaw (CVE-2026-69893) allows privilege escalation.
No in-the-wild exploitation is reported in this advisory; it is a standard patch notification. NCSC-NL recommends installing Microsoft's available updates and consulting the Microsoft Security Response Center portal for details, workarounds, and installation guidance. Defenders running SQL Server, its JDBC driver, or AKS should prioritize patching given the high proportion of RCE and privilege-escalation impacts, particularly the unauthenticated critical overflow.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0476.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs