Microsoft SQL Server Remote Code Execution Vulnerability
Published October 13, 2026Updated October 13, 2026
Source data
Overview
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Impact & technical details
Remote Code Execution
I am running SQL Server on my system. What action do I need to take? Update your relevant version of SQL Server using the applicable October 2026 security update listed below. There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? First, determine your SQL Server version number. For more information, see Microsoft Knowledge Base Article 321185 - How to determine the version, edition, and update level of SQL Server and its components. Second, locate the range containing your current version number in the following table. The corresponding update is the one you need to install. Note: If your version is not represented in the table, review the applicable update's prerequisites and the support status of your SQL Server release before choosing an update. Absence from this table alone does not establish that a version is unsupported. Update Number Title Version Apply if current product version is… This security update also includes servicing releases up through… 5126967 SQL Server 2025 CU9+GDR (October GDR 2026) 17.0.5015.4 17.0.4006.2 - 17.0.5005.3 KB5122048 - SQL2025 RTM CU9 5128492 SQL Server 2025 RTM+GDR (October GDR 2026) 17.0.1145.4 17.0.1000.7 - 17.0.1135.8 KB5122770 - Previous SQL2025 RTM GDR 5126934 SQL Server 2022 CU27+GDR1 (October GDR 2026) 16.0.4305.5 16.0.4003.1 - 16.0.4295.3 KB5104824 - SQL2022 RTM CU27 5128493 SQL Server 2022 RTM+GDR (October GDR 2026) 16.0.1210.3 16.0.1000.6 - 16.0.1200.5 KB5122771 - Previous SQL2022 RTM GDR 5128494 SQL Server 2019 CU32+GDR (October GDR 2026) 15.0.4500.2 15.0.4003.23 - 15.0.4490.9 KB5122772 - Previous SQL2019 RTM CU32 GDR 5128495 SQL Server 2019 RTM+GDR (October GDR 2026) 15.0.2200.2 15.0.2000.5 - 15.0.2190.7 KB5122773 - Previous SQL2019 RTM GDR 5128496 SQL Server 2017 CU31+GDR (October GDR 2026) 14.0.3560.2 14.0.3006.16 - 14.0.3550.4 KB5122774 - Previous SQL2017 RTM CU31 GDR 5128497 SQL Server 2017 RTM+GDR (October GDR 2026) 14.0.2140.2 14.0.1000.169 - 14.0.2130.4 KB5122775 - Previous SQL2017 RTM GDR What are the GDR and CU update designations and how do they differ? General Distribution Release (GDR) updates provide security and other broadly applicable critical fixes. Cumulative Updates (CUs) include accumulated fixes for the applicable SQL Server release. Use the version ranges above to select the security update for your installed servicing branch; CU+GDR updates apply to the listed CU branch, while RTM+GDR updates apply to the listed RTM
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability? An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.
- CVSS base score
- 6.6 / 10
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Highest base score supplied by MSRC for this record; the vector belongs to that score. Ratings can vary by product. Microsoft Important is displayed as High; Moderate is displayed as Medium.
Affected products
- Microsoft SQL Server 2022 for x64-based Systems (CU27)
- Microsoft SQL Server 2022 for x64-based Systems (GDR)
- Microsoft SQL Server 2025 for x64-based Systems (CU8)
- Microsoft SQL Server 2025 for x64-based Systems (CU9)
- Microsoft SQL Server 2025 for x64-based Systems (GDR)
Source guidance
Remediation
The source provides update references without a separate remediation summary. Review the applicable update links below.
At least one Microsoft vendor-fix reference is available. Check each affected product for its applicable update, prerequisites, and supported version.
GTP recommendation · Rule-based guidance
Recommended next step
Review affected Microsoft products and apply the applicable security updates through your organization's normal patch-management process. Confirm availability and prerequisites in the Microsoft advisory.
Authoritative sources & updates
Findings and update information come from the linked publishers. GTP compiles the public record and provides the recommendation above. CVSS ratings shown here come from Microsoft. NVD references provide additional public context.
- Microsoft Security Response Center (opens in a new tab)
- Microsoft security update · 5128492 (opens in a new tab)
- Microsoft remediation guidance (opens in a new tab)
- Microsoft security update · 5128493 (opens in a new tab)
- Microsoft remediation guidance (opens in a new tab)
- Microsoft security update · 5126934 (opens in a new tab)
- Microsoft remediation guidance (opens in a new tab)
- Microsoft security update · 5126967 (opens in a new tab)
- Microsoft remediation guidance (opens in a new tab)
Managed by GTP?
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.