# Microsoft patches 55 SQL Server flaws

Published: 2026-11-10 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/7851b201-4db1-503c-804d-fd999a5cde33/microsoft-patches-55-sql-server-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> NCSC-NL advisory: Microsoft fixed 55 vulnerabilities in SQL Server, its JDBC driver and Azure Kubernetes Service, including a critical 9.8 heap overflow enabling remote code execution.

Source: advisories.ncsc.nl — https://advisories.ncsc.nl/2026/ncsc-2026-0476.html

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

NCSC-NL (Netherlands' national CSIRT) published an advisory summarizing Microsoft's patches for 55 vulnerabilities across SQL Server, the JDBC Driver for SQL Server, and Azure Kubernetes Service. The flaws span a wide range of weakness classes including heap- and stack-based buffer overflows, SQL and command injection, privilege escalation, authentication bypass via replay, cryptographic signature verification issues, and use of broken cryptographic algorithms. Most vulnerabilities result in either arbitrary code execution or privilege escalation, with several also enabling sensitive data disclosure.

The most severe issue, CVE-2026-116945 (CVSS 9.8), is a heap-based buffer overflow in SQL Server: an unauthenticated attacker who controls a network endpoint that a vulnerable integration package connects to can return a specially crafted response, leading to arbitrary code execution with the privileges of the integration service. Numerous other CVEs (e.g., 116930, 116934, 116941, 116942, 118105, 118109, 118110, 118120, 67374, 67387, 67391, 67632, 67637, 94511) carry CVSS scores of 8.0-8.8 and similarly allow code execution or elevation of privilege. A separate flaw in the JDBC Driver for SQL Server (CVE-2026-70003, CVSS 8.7) allows a security control bypass, and an Azure Kubernetes Service flaw (CVE-2026-69893) allows privilege escalation.

No in-the-wild exploitation is reported in this advisory; it is a standard patch notification. NCSC-NL recommends installing Microsoft's available updates and consulting the Microsoft Security Response Center portal for details, workarounds, and installation guidance. Defenders running SQL Server, its JDBC driver, or AKS should prioritize patching given the high proportion of RCE and privilege-escalation impacts, particularly the unauthenticated critical overflow.

## Mentioned in this report

- Vulnerabilities: CVE-2026-116929, CVE-2026-116930, CVE-2026-116931, CVE-2026-116933, CVE-2026-116934, CVE-2026-116936, CVE-2026-116937, CVE-2026-116938, CVE-2026-116941, CVE-2026-116942, CVE-2026-116943, CVE-2026-116944, CVE-2026-116945, CVE-2026-116946, CVE-2026-116947, CVE-2026-118105, CVE-2026-118106, CVE-2026-118108, CVE-2026-118109, CVE-2026-118110, CVE-2026-118111, CVE-2026-118112, CVE-2026-118113, CVE-2026-118114, CVE-2026-118115, CVE-2026-118117, CVE-2026-118118, CVE-2026-118119, CVE-2026-118120, CVE-2026-45478, CVE-2026-66813, CVE-2026-67374, CVE-2026-67387, CVE-2026-67391, CVE-2026-67632, CVE-2026-67637, CVE-2026-67646, CVE-2026-70003, CVE-2026-94511, CVE-2026-94513

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0476.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7851b201-4db1-503c-804d-fd999a5cde33/microsoft-patches-55-sql-server-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup