Microsoft SQL Server: heap buffer overflow and command injection (CVE-2026-116945, CVE-2026-116930) fixed in builds listed by Microsoft
CVE-2026-116929 CVE-2026-116930 CVE-2026-116945
Published 11/11/2026 19:52
Timeline
2 events over 1 d 2 h
- 10/11/2026 17:00ConfirmedMicrosoft Security Update Guide+1 d 2 h
- 11/11/2026 19:52Published on WatchtowerPro CISO
In short
Microsoft fixed three SQL Server flaws on 10/11/2026, including a critical heap buffer overflow (CVE-2026-116945, CVSS 9.8) that allows code execution. Fixed builds exist for SQL Server 2017, 2019, 2022 and 2025. No exploitation is known; install the fixed build for your branch.
How bad is it
Critical. An attacker who controls a network endpoint that a vulnerable SQL Server integration package connects to can run code on the server, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 3 CVEs · CVSS 3.1 from NVD, from microsoft.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- SQL Server 2017 (GDR from 14.0.0, CU31 from 14.0.3006.16), x64 builds, before the fixed builds listed
- SQL Server 2019 (GDR from 15.0.0, CU32 from 15.0.4003.23), x64 builds, before the fixed builds listed
- SQL Server 2022 (GDR from 16.0.0, CU27 from 16.0.4003.1), x64 builds, before the fixed builds listed
- SQL Server 2025 (GDR from 17.0.1050.2, CU10 from 17.0.4006.0), x64 builds, before the fixed builds listed
What to do now
- Install the fixed build matching your branch: 2017 GDR 14.0.2150.2 or CU31 14.0.3570.2; 2019 GDR 15.0.2210.4 or CU32 15.0.4510.2; 2022 GDR 16.0.1220.3 or CU27 16.0.4315.2; 2025 GDR 17.0.1155.3 or CU10 17.0.5045.3. GDR systems need the GDR build, CU systems the CU build.
- Microsoft's records name no workaround. As general hygiene, not vendor guidance, restrict network access to SQL Server instances from the internet and untrusted networks. This reduces exposure but does not make a server safe; only the update does.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 8 sources with their dates. And technology matching: which of your systems run Microsoft SQL Server, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-116929 Microsoft SQL Server Elevation of Privilege Vulnerability Vendor · CVE-2026-116930 Microsoft SQL Server Remote Code Execution Vulnerability Vendor · CVE-2026-116945 Microsoft SQL Server Remote Code Execution Vulnerability Vendor