CVE-2026-85888

7.7High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-125

Impact

Authenticated attackers can exfiltrate sensitive memory contents across the network. They need valid credentials to query the SQL Server instance.

Root cause

An out-of-bounds read vulnerability allows memory disclosure during request handling.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fix & remediation

Apply the security update provided by Microsoft in the referenced MSRC advisory. If patching must wait, restrict network access to SQL Server ports (default TCP 1433) to trusted application hosts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85888

Source: nvd.nist.gov/vuln/detail/CVE-2026-85888