Serious vulnerability in Microsoft SQL Server

Microsoft has released security updates for the vulnerability CVE-2026-116945 in Microsoft SQL Server. It receives a severity rating of 9.8 out of 10 and can allow unauthorized parties to execute malicious code without logging in. The updates cover SQL Server 2017, 2019, 2022, and 2025. Older versions are no longer supported by Microsoft but likely also contain this flaw.

Microsoft has also been dealing with widespread disruptions to Outlook, Teams, Copilot, and other services since yesterday, November 12. In a status update this morning, the company reported increased stability following fixes to the authentication and routing components of the systems. These are being deployed more broadly, and the restoration of services to full functionality is still ongoing. Microsoft says it has no indications that an attack was the cause.

Microsoft has not confirmed a link between these disruptions and the SQL Server vulnerability discussed here. Disruptions to Microsoft cloud services are outside APRÓ's scope of influence. On the other hand, the responsibility for updating on-premises SQL Server instances lies with the operators of the relevant systems, and APRÓ's specialists can assist with status assessments and remediation.

WHAT IS THIS SQL FLAW?
The flaw is a memory overflow error (“heap-based buffer overflow”), which means, for example, that an attacker can open a network connection to an SQL server and send a specially crafted request. During processing, malicious code can execute with the privileges of the integration service, without any further user action if the process runs automatically.

The consequences depend on the privileges of the service. These include data theft, alteration, or deletion of data, and potentially further attacks within the organization. Therefore, simply closing a database server to direct access from the internet is not sufficient on its own. Its connections to other systems must also be reviewed.

HOW WIDESPREAD IS THE IMPACT?
The Microsoft SQL database engine serves millions of Microsoft customers worldwide. However, that figure does not indicate how many databases are exposed to this vulnerability.

Here in Iceland, an attack on a sensitive environment within the business sector could disrupt operations and services, and put confidential information at risk. The extent depends on the update status, integrations, and access privileges of each environment.

At the time the update was released, Microsoft was not aware of the vulnerability being exploited in attacks. Operators should nevertheless review their systems and install the relevant updates as soon as possible.

APRÓ: ASSESSMENT AND REMEDIATION
APRÓ's Microsoft SQL Server specialists assist with status assessments and remediation. Contact us and get a review of your environment.