CVE-2026-94520

Microsoft SQL Server Denial of Service Vulnerability

Published Oct 13, 2026 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Description
Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Microsoft sql Server 2025 For X64-based Systems Cu10
CPEs cpe:2.3:a:microsoft:sql_server_2025_for_x64-based_systems_cu10:*:*:*:*:*:*:*:*
Vendors & Products Microsoft sql Server 2025 For X64-based Systems Cu10
Type Values Removed Values Added
First Time appeared Microsoft microsoft Sql Server 2017 (gdr)
Microsoft microsoft Sql Server 2019 (gdr)
Microsoft microsoft Sql Server 2022 (gdr)
Microsoft microsoft Sql Server 2025 For X64-based Systems (gdr)
Vendors & Products Microsoft microsoft Sql Server 2017 (gdr)
Microsoft microsoft Sql Server 2019 (gdr)
Microsoft microsoft Sql Server 2022 (gdr)
Microsoft microsoft Sql Server 2025 For X64-based Systems (gdr)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.
Title Microsoft SQL Server Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft microsoft Sql Server 2017 For X64-based Systems \(cu31\)
Microsoft microsoft Sql Server 2019 For X64-based Systems \(cu32\)
Microsoft microsoft Sql Server 2022 For X64-based Systems \(cu27\)
Microsoft microsoft Sql Server 2025 For X64-based Systems \(cu9\)
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
Weaknesses CWE-134
CPEs cpe:2.3:a:microsoft:microsoft_sql_server_2017_for_x64-based_systems_\(cu31\):*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_sql_server_2019_for_x64-based_systems_\(cu32\):*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_sql_server_2022_for_x64-based_systems_\(cu27\):*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_sql_server_2025_for_x64-based_systems_\(cu9\):*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_2017:*:-:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*
Vendors & Products Microsoft
Microsoft microsoft Sql Server 2017 For X64-based Systems \(cu31\)
Microsoft microsoft Sql Server 2019 For X64-based Systems \(cu32\)
Microsoft microsoft Sql Server 2022 For X64-based Systems \(cu27\)
Microsoft microsoft Sql Server 2025 For X64-based Systems \(cu9\)
Microsoft sql Server 2017
Microsoft sql Server 2019
Microsoft sql Server 2022
Microsoft sql Server 2025
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}