CVE-2026-88088

HIGH 7.0CVE-2026-88088 · Published 13/10/2026 · updated 02/11/2026

In short

CVE-2026-88088 is a HIGH (CVSS 7.0) vulnerability affecting sql server 2019 (microsoft), sql server 2022 (microsoft), sql server 2025 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 14.7% of all vulnerabilities.
Fix: update to 15.0.2200.2, 15.0.4500.2, 16.0.1210.3, 16.0.4305.5 or later.

Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2026-88088 is a HIGH (CVSS 7.0) vulnerability affecting sql server 2019 (microsoft), sql server 2022 (microsoft), sql server 2025 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 14.7% of all vulnerabilities.

Fix: update to 15.0.2200.2, 15.0.4500.2, 16.0.1210.3, 16.0.4305.5 or later.

Package

Affected versions

Patched versions

≥ 15.0.2000.5, < 15.0.2200.2≥ 15.0.4003.23, < 15.0.4500.2

15.0.2200.215.0.4500.2

≥ 16.0.1000.6, < 16.0.1210.3≥ 16.0.4003.1, < 16.0.4305.5

16.0.1210.316.0.4305.5

≥ 17.0.1000.7, < 17.0.1145.4≥ 17.0.4006.2, < 17.0.5015.4

17.0.1145.417.0.5015.4

More vulnerabilities in sql server 2019

See all →