Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-69562: SQL Server could expose data to remote attackers
CVE-2026-69562 · published 1 month ago
Summary
Versions of Microsoft SQL Server 2017 and 2019 may let an unauthenticated user read internal information over the network. This could reveal configuration details or other sensitive data. Apply the latest security updates from Microsoft to fix the issue.
What to do
- Update microsoft microsoft sql server 2017 (cu 31) to version 14.0.3550.4 or later.
- Update microsoft microsoft sql server 2017 (gdr) to version 14.0.2130.4 or later.
- Update microsoft microsoft sql server 2019 (cu 32) to version 15.0.4490.9 or later.
- Update microsoft microsoft sql server 2019 (gdr) to version 15.0.2190.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft sql server 2017 (cu 31) | < 14.0.3550.4 |
| microsoft | microsoft sql server 2017 (gdr) | < 14.0.2130.4 |
| microsoft | microsoft sql server 2019 (cu 32) | < 15.0.4490.9 |
| microsoft | microsoft sql server 2019 (gdr) | < 15.0.2190.7 |
| microsoft | sql_server_2017 |
< 14.0.2130.4 >= 14.0.3006.16, < 14.0.3550.4 cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:* |
| microsoft | sql_server_2019 |
< 15.0.2190.7 >= 15.0.4003.23, < 15.0.4490.9 cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:* |
Original advisory text
Microsoft SQL Server Information Disclosure Vulnerability
Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69562 vendor-advisory patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-125Out-of-bounds Read
Timeline
Published8 Sep 2026
Updated3 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta