Summary
Microsoft heeft 55 kwetsbaarheden verholpen in diverse componenten van SQL Server.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabel.
De kwetsbaarheid met kenmerk CVE-2026-116945, heeft een CVSS-score van 9.8 en betreft een heap-based buffer overflow in Microsoft SQL Server. Een ongeautoriseerde kwaadwillende die controle heeft over een netwerkeindpunt waarmee een kwetsbaar integratiepakket verbinding maakt, kan een speciaal geprepareerd antwoord terugsturen. Wanneer het integratiepakket dit antwoord verwerkt, kan de kwaadwillende willekeurige code uitvoeren met de rechten van de integratieservice.
```
SQL Server:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-116929 | 7,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-116930 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-116931 | 7,50 | Uitvoeren van willekeurige code |
| CVE-2026-116932 | 6,50 | Toegang tot gevoelige gegevens |
| CVE-2026-116933 | 7,20 | Uitvoeren van willekeurige code |
| CVE-2026-116934 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-116935 | 6,50 | Toegang tot gevoelige gegevens |
| CVE-2026-116936 | 7,20 | Uitvoeren van willekeurige code |
| CVE-2026-116937 | 7,50 | Uitvoeren van willekeurige code |
| CVE-2026-116938 | 7,50 | Uitvoeren van willekeurige code |
| CVE-2026-116939 | 5,70 | Toegang tot gevoelige gegevens |
| CVE-2026-116940 | 4,90 | Toegang tot gevoelige gegevens |
| CVE-2026-116941 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-116942 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-116943 | 7,50 | Toegang tot gevoelige gegevens |
| CVE-2026-116944 | 7,20 | Verkrijgen van verhoogde rechten |
| CVE-2026-116945 | 9,80 | Uitvoeren van willekeurige code |
| CVE-2026-116946 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-116947 | 7,50 | Uitvoeren van willekeurige code |
| CVE-2026-118102 | 5,90 | Toegang tot gevoelige gegevens |
| CVE-2026-118103 | 6,50 | Toegang tot gevoelige gegevens |
| CVE-2026-118104 | 6,50 | Toegang tot gevoelige gegevens |
| CVE-2026-118105 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-118106 | 8,10 | Uitvoeren van willekeurige code |
| CVE-2026-118108 | 7,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-118109 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-118110 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-118111 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118112 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118113 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118114 | 7,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-118115 | 7,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-118116 | 7,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118117 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118118 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118119 | 8,00 | Verkrijgen van verhoogde rechten |
| CVE-2026-118120 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-45478 | 7,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-62903 | onb. | Toegang tot gevoelige gegevens |
| CVE-2026-66813 | 8,10 | Verkrijgen van verhoogde rechten |
| CVE-2026-67372 | onb. | Uitvoeren van willekeurige code |
| CVE-2026-67374 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-67382 | 6,50 | Toegang tot gevoelige gegevens |
| CVE-2026-67387 | 8,80 | Verkrijgen van verhoogde rechten |
| CVE-2026-67391 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-67632 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-67637 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-67646 | onb. | Uitvoeren van willekeurige code |
| CVE-2026-68783 | onb. | Toegang tot gevoelige gegevens |
| CVE-2026-84010 | 7,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-88111 | 7,50 | Uitvoeren van willekeurige code |
| CVE-2026-94511 | 8,80 | Uitvoeren van willekeurige code |
| CVE-2026-94513 | 8,00 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
JDBC Driver for SQL Server:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-70003 | 8,70 | Omzeilen van beveiligingsmaatregel |
|------------------|------|-------------------------------------|
Microsoft Azure Kubernetes Service:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-69893 | onb. | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 53
-
Critical 9.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.7
JDBC Driver for SQL Server Security Feature Bypass Vulnerability
Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.1
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
-
High 8.1
Microsoft SQL Server Elevation of Privilege Vulnerability
Out-of-bounds read in SQL Server allows an unauthorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.5
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.5
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.5
Microsoft SQL Server Information Disclosure Vulnerability
Buffer over-read in SQL Server allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft SQL Server Elevation of Privilege Vulnerability
Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.4
Microsoft.Data.SqlClient Information Disclosure Vulnerability
Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.
-
High 7.2
Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.2
Microsoft SQL Server Remote Code Execution Vulnerability
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 7.2
Microsoft SQL Server Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 6.5
Microsoft SQL Server Information Disclosure Vulnerability
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 5.9
Microsoft SQL Server Information Disclosure Vulnerability
Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.
-
Medium 5.7
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
-
Medium 4.9
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://portal.msrc.microsoft.com/en-us/security-guidance