CVE-2026-88085

MEDIUM 6.4CVE-2026-88085 · Published 13/10/2026 · updated 02/11/2026

In short

CVE-2026-88085 is a MEDIUM (CVSS 6.4) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.0% of all vulnerabilities.
Fix: update to 14.0.2140.2, 14.0.3560.2, 15.0.2200.2, 15.0.4500.2 or later.

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2026-88085 is a MEDIUM (CVSS 6.4) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.0% of all vulnerabilities.

Fix: update to 14.0.2140.2, 14.0.3560.2, 15.0.2200.2, 15.0.4500.2 or later.

Package

Affected versions

Patched versions

≥ 14.0.1000.169, < 14.0.2140.2≥ 14.0.3006.16, < 14.0.3560.2

14.0.2140.214.0.3560.2

≥ 15.0.2000.5, < 15.0.2200.2≥ 15.0.4003.23, < 15.0.4500.2

15.0.2200.215.0.4500.2

≥ 16.0.1000.6, < 16.0.1210.3≥ 16.0.4003.1, < 16.0.4305.5

16.0.1210.316.0.4305.5

≥ 17.0.1000.7, < 17.0.1145.4≥ 17.0.4006.2, < 17.0.5015.4

17.0.1145.417.0.5015.4

More vulnerabilities in sql server 2017

See all →