What is the CVSS score of CVE-2026-78456?

CVE-2026-78456 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate CVE-2026-78456?

Within 24 hours, audit all SQL Server 2022 instances across your environment to identify which runs GDR or CU 26 builds and assess network access patterns to understand authentication exposure. Within 7 days, deploy the vendor-released patches from Microsoft to all affected systems, beginning with production instances and following change management procedures; separate patches are available for both GDR and CU 26 servicing branches. Within 30 days, complete patch deployment across all environments, validate patch installation against Microsoft's fixed build versions, and document remediation status for compliance and audit purposes.

Microsoft SQL Server CVE-2026-78456

Q: Which versions of Microsoft SQL Server are affected by CVE-2026-78456?

Microsoft SQL Server 2022 contains a vulnerability that allows low-privileged database users to execute arbitrary code on database servers, potentially exposing sensitive business data and enabling…. A patch is available.

EUVD-2026-73809 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-09-08 secure@microsoft.com

GHSA-h57r-w39w-33fc

Buffer Overflow Heap Overflow Microsoft Sql Server 2022

8.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege SQL Server credential
Delivery

Connect to SQL Server listener over network (TCP 1433)
Exploit

Send crafted malformed query or protocol message
Execution

Trigger heap-based buffer overflow in SQL Server process
Persist

Overwrite heap metadata or function pointer
Impact

Execute arbitrary code as SQL Server service account

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a valid SQL Server account with at minimum low-level privileges - such as a standard read-only database user, application service account, or guest-equivalent login (PR:L per CVSS). The attack is fully network-reachable (AV:N) with no requirement for local system access; connectivity to the SQL Server listener port (default TCP 1433) is sufficient. No user interaction is required and attack complexity is low, indicating no race conditions or precise timing are needed. The binding limiting factor is the credential requirement: fully unauthenticated exploitation from the internet is not supported by the available data. No specific SQL Server feature, configuration setting, or non-default option is identified in the available sources as a prerequisite - the overflow appears to reside in core network request processing.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H captures the key risk drivers: a low-privileged SQL Server account is sufficient, the attack requires no special complexity or user interaction, and success yields full confidentiality, integrity, and availability compromise of the SQL Server instance. No EPSS probability was provided in the input data, so near-term exploitation probability cannot be precisely quantified. The vulnerability is not currently in CISA KEV, and no public POC has been identified, which moderates immediate escalation. However, the combination of low attack complexity, authenticated-but-low-privilege access requirements, and total impact means any organization with exposed SQL Server instances should treat this as urgent - patch deferral windows should be measured in days, not weeks.
Exploit ScenarioDerived	An attacker who has obtained a low-privileged SQL Server login - through credential stuffing, phishing a developer, or compromising an application service account - connects to the SQL Server listener over the network and sends a crafted malformed request that triggers the heap-based buffer overflow. By overwriting adjacent heap structures, the attacker redirects SQL Server's execution flow to shellcode or a ROP chain, achieving code execution under the SQL Server service account (typically NT SERVICE\MSSQLSERVER or a domain service account). This yields full read/write access to all hosted databases, extraction of all credentials, and potential lateral movement via linked servers.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 08, 2026

Heap-based buffer overflow in Microsoft SQL Server 2022 enables an authenticated low-privileged network attacker to execute arbitrary code on the database server host. Both the GDR and CU 26 servicing branches of SQL Server 2022 are affected, with Microsoft having released fixed builds in both channels. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and full network reachability make this a high-priority patching target for any organization running SQL Server 2022.

RemediationAI

Apply the Microsoft-released patches immediately: update SQL Server 2022 GDR installations to build 16.0.1200.5 or later, and CU 26 installations to 16.0.4275.2 or later, via the Microsoft Update Catalog, WSUS, or the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78456. If patching cannot be completed immediately, restrict TCP 1433 (and any custom SQL Server listener ports) access to only known trusted application servers and administrative hosts using host-based firewall rules or network ACLs - this reduces the attacker pool to those with both network access and a valid low-privilege account. Additionally, audit and rotate SQL Server login credentials, particularly for service accounts, to limit the number of valid PR:L credentials in attacker reach. Note that network restriction is a compensating control only and does not eliminate the underlying flaw.

Affected VersionsENISA

Microsoft SQL Server 2022 (GDR) 16.0.0 <16.0.1200.5

Microsoft SQL Server 2022 (CU 26) 16.0.0.0 <16.0.4275.2

Affected Packages

euvd microsoft_sql_server_2022_cu_26 fix: 16.0.4275.2

euvd microsoft_sql_server_2022_gdr fix: 16.0.1200.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-122 (Heap-based Buffer Overflow): attacker-controlled input triggers a write past the bounds of a heap-allocated buffer within SQL Server's network-facing query or command processing code, potentially overwriting adjacent heap metadata, vtable pointers, or return addresses. SQL Server 2022 (internal version 16.x) is affected in two servicing branches: the GDR (General Distribution Release) track up to 16.0.1200.4, and the CU (Cumulative Update) 26 track up to 16.0.4275.1. The CPE data from EUVD precisely scopes exposure to those sub-ranges. The Microsoft Security Response Center (MSRC) is the authoritative reporter via secure@microsoft.com.

Know when Sql Server 2022 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

vuln.today AI 8.8 HIGH

Authenticated low-privilege network access required; heap overflow yields full confidentiality, integrity, and availability compromise with no user interaction or special complexity.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:20 nvd

HIGH 8.8

DescriptionCVE.org

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

Microsoft SQL Server 2022 contains a vulnerability that allows low-privileged database users to execute arbitrary code on database servers, potentially exposing sensitive business data and enabling system compromise. This affects both the standard (GDR) and regular monthly (CU 26) update tracks. Organizations running SQL Server 2022 should prioritize patching to prevent insider threats from database users and reduce risk of data breach.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.9%

Top 44% exploitable

Prevalence

High

widely deployed enterprise relational database across industries globally

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.9%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.