.NET Denial of Service Vulnerability
CVE-2026-120796
Summary
External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.
Products covered
Microsoft SQL Server 2025 for x64-based Systems (CU4)
Microsoft SQL Server 2022 for x64-based Systems (CU 24)
Microsoft SQL Server 2017 for x64-based Systems (GDR)
Microsoft SQL Server 2019 for x64-based Systems (GDR)
Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)
Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connect Feature Pack
Microsoft SQL Server 2017 for x64-based Systems (CU 31)
Microsoft SQL Server 2022 for x64-based Systems (GDR)
Show 2 more products
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Microsoft SQL Server 2019 for x64-based Systems (CU 32)
Remediation
Install KB5089899. Install KB5089900. Install KB5090347. Install KB5090408. Install KB5089271. Install KB5089270. Install KB5090354. Install KB5091158. Install KB5091223. Install KB5090407.
Vendor-listed fixes
17.0.4040.1
16.0.4252.3
14.0.2110.2
15.0.2170.1
13.0.6490.1
13.0.7085.1
14.0.3530.2
16.0.1180.1
Show 2 more fixes
17.0.1115.1
15.0.4470.1
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.