Summary
Microsoft heeft kwetsbaarheden verholpen in diverse componenten van SQL Server.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en/of toegang te krijgen tot gevoelige gegevens.
```
SQL Server:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-47296 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-54117 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-54118 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-55002 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-47295 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-50468 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-54116 | 6.50 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Microsoft Fabric Data Warehouse:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-56642 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
Power BI:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-58647 | 8.00 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 9
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.
-
High 8.0
Microsoft PowerBI Report Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network.
Revision history
-
#1.0.0
Initiele versie