CVE-2026-94513: SQL Server 2022 and 2025 Privilege Escalation Fixes by Build

What Microsoft disclosed​

Microsoft's official description is one sentence: "Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network." The public CVE record classifies the weakness as CWE-122, a heap-based buffer overflow. Microsoft is listed as the assigning authority, and Microsoft's Security Update Guide is tagged as the vendor advisory and patch reference.

Microsoft's Security Update Guide lists the bulletin as released Nov 10, 2026. Its guidance is short: "Update your relevant version of SQL Server using the applicable November 2026 security update listed below."

The disclosure does not describe the vulnerable code path, the trigger conditions, the specific SQL Server component involved, or how an attacker would exploit it. No public proof-of-concept has been reported. Microsoft has confirmed that the flaw exists, but the technical details are still private.

Section summary: This is a confirmed Microsoft vulnerability in SQL Server. It is a heap overflow that lets an already-authorized attacker gain more privileges over the network. The exploit mechanics have not been published.

Affected builds and the fixes that close them​

The CVE record lists four x64 servicing tracks. Each has its own fixed build, and these are separate branches, not one continuous version range. Microsoft's update guide maps each track to a specific November 2026 package:

Microsoft's update table confirms these package-to-build pairings. For example, KB 5129299 is "SQL Server 2025 CU10+GDR (November GDR 2026)" at build 17.0.5045.3, and KB 5132747 is "SQL Server 2022 RTM+GDR (November GDR 2026)" at 16.0.1220.3. Microsoft's support articles for KB5132747 and KB5132748 each list CVE-2026-94513 among the fixes.

Microsoft's table and the CVE record differ in two ways:

• Applicable install ranges differ slightly from the CVE's affected ranges. Microsoft's table says the SQL Server 2025 RTM GDR package applies to builds 17.0.1000.7 through 17.0.1145.4. The CVE record starts that affected range at 17.0.1050.2. The first figure tells you which builds can install the package. The second tells you which builds are listed as vulnerable. For patching, the fixed-build column is the number that matters.
• SQL Server 2019 and 2017 also appear in the update table. Microsoft's November table includes rows for SQL Server 2019 CU32+GDR (15.0.4510.2), SQL Server 2019 RTM+GDR (15.0.2210.4), SQL Server 2017 CU31+GDR (14.0.3570.2) and SQL Server 2017 RTM+GDR (14.0.2150.2). However, the CVE record lists only SQL Server 2022 and 2025 as affected by this particular CVE. The available evidence does not explain the difference. It may be a shared table covering all of the month's SQL Server fixes. Either way, admins running 2019 or 2017 have November security updates to deploy and should read the advisories that apply to their versions.

Section summary: Find your instance's version and servicing track (GDR or CU), then compare its build against that track's fixed build. A CU threshold is not interchangeable with a GDR threshold.

Reading the 8.0 score correctly​

Microsoft scored the flaw CVSS 3.1 base 8.0 (High) with the vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. In plain terms:

• Network attack vector: the attacker doesn't need local console access.
• High attack complexity and high privileges required: the attacker needs elevated access and favorable conditions before attempting exploitation.
• Scope changed: a successful exploit can affect resources beyond the vulnerable component. That's why the score stays high despite the prerequisites.
• High impact to confidentiality, integrity and availability.

Microsoft's full vector includes E:U, meaning exploit code maturity is unproven. A CISA enrichment added on November 11 rates exploitation as "none," automation as "no," and technical impact as "total." At the time of this snapshot, OpenCVE showed that the CVE was not in CISA's Known Exploited Vulnerabilities catalog and gave it an exploit-prediction score of about 0.55% over 30 days. NVD's status was still "Awaiting Analysis," so no independent NVD assessment exists yet. These are point-in-time readings and can change.

Third-party scores differ. VulDB rates the issue "very critical", says "The exploitation appears to be easy.", and its metadata lists a CVSS of 9.1 under CWE-120. That conflicts with Microsoft's high-complexity, high-privilege rating. Microsoft's vendor-assigned vector is the more authoritative source because Microsoft has seen the root cause. VulDB's figures are its own estimate.

Section summary: This flaw is serious, but it is not an unauthenticated network takeover. An attacker needs privileged access first. No exploitation has been reported as of this writing.

Why "authorized attacker" doesn't mean "low priority"​

Privilege-escalation bugs that require high privileges are easy to deprioritize. That can be a mistake for several reasons:

• Compromised credentials are common. A stolen service account, a leaked connection string or a malicious insider can meet the "authorized" requirement.
• Scope change is the dangerous part. A changed scope means the impact can extend beyond the boundary of the vulnerable component. That gives an attacker a way out of whatever containment the existing privileges were supposed to enforce.
• These updates fix more than one CVE. Microsoft's KB5132747 summary also lists CVE-2026-67632 and CVE-2026-67637, both Microsoft SQL Server Remote Code Execution Vulnerabilities. KB5132748 for SQL Server 2025 GDR lists CVE-2026-116941 and CVE-2026-67632 as remote code execution issues. Security vendor Senserva counts a large number of fixes in the SQL Server 2022 GDR package. Its analysis says a single reboot-and-restart window can close all 47 at once. Even if you consider CVE-2026-94513 alone a moderate risk, the remote code execution fixes in the same packages make a strong case for scheduling the update.

Practical checklist for DBAs​

1. Inventory every instance. Include named instances, Always On replicas and failover cluster nodes. Running SELECT SERVERPROPERTY('ProductVersion'), SERVERPROPERTY('ProductUpdateLevel'); or SELECT @@VERSION; returns the build and update level. This is standard SQL Server administration practice, not a step from the advisory.
2. Identify each instance's track. A build in the 16.0.1xxx range is on the 2022 RTM GDR track. A build in the 16.0.4xxx range is on the CU track. The same pattern applies to 17.0.1xxx and 17.0.4xxx/5xxx on SQL Server 2025.
3. Compare against the fixed build in the table above, and deploy the matching November package.
4. Read each package's known-issues section before rollout. For example, Senserva's summary of KB5129300 flags monitoring queries against sys.dm_exec_requests or sys.sysprocesses on secondary replicas that might return error 976 or error 978 under a specific trace-flag condition. Availability group operators should check whether that applies to them.
5. Audit elevated permissions. Because exploitation requires high privileges, review sysadmin and other elevated role memberships and remove access that isn't needed. This is a defense-in-depth measure and does not replace the patch.
6. Record the result. Log the before and after build numbers per instance for change control and audit.

The advisory does not name a specific port, protocol or firewall rule that blocks this flaw. General network segmentation of database servers is still good practice, but there is no advisory-specific workaround.

The bottom line​

CVE-2026-94513 is the type of SQL Server flaw that becomes dangerous after an attacker has already gained privileged access. It requires high privileges and favorable conditions, it has not been exploited in the wild, and its details are still private. The November updates also fix several remote code execution vulnerabilities, which makes the patch window worth scheduling soon. Check each instance's build against its servicing track and apply the matching update.