Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-96956

SQL Server Elevation of Privilege Vulnerability

CVE-2026-96956: SQL Server Elevation of Privilege Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 8, MS Server).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-96956 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
8 (MS Server), 7.5 (Red Hat)
Weakness
CWE-770
Fixed releases
  • MS Server: KB5128496 (build 14.0.3560.2), KB5128497 (build 14.0.2140.2), KB5128495 (build 15.0.2200.2), KB5126934 (build 16.0.4305.5), KB5128492 (build 17.0.1145.4), KB5126967 (build 17.0.5015.4) and 2 more in the advisory
Vendor advisories
2 from MS Server, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-96956; bulletin-wide values are not repeated here.

Is CVE-2026-96956 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-96956 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-96956?

Upgrade to a fixed release named by the vendor:

  • MS Server: KB5128496 (build 14.0.3560.2), KB5128497 (build 14.0.2140.2), KB5128495 (build 15.0.2200.2), KB5126934 (build 16.0.4305.5), KB5128492 (build 17.0.1145.4), KB5126967 (build 17.0.5015.4)
  • Install the applicable security update for your platform: KB5128496, KB5128497, KB5128495, KB5126934, KB5128492, KB5126967 (see the Microsoft Update Catalog). (MS Server)

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityHigh8.0

    High [CVE-2026-96956] SQL Server Elevation of Privilege Vulnerability

    CVE-2026-96956Source published Source updated

    SQL Server Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft SQL Server 2017; Microsoft SQL Server 2019; Microsoft SQL Server 2022; Microsoft SQL Server 2025.

    Affected products in this advisory
    • Microsoft SQL Server 2017
    • Microsoft SQL Server 2019
    • Microsoft SQL Server 2022
    • Microsoft SQL Server 2025
    Source-reported affected versions
    • Microsoft SQL Server 2017 (GDR) 14.0.0 before 14.0.2140.2
    • Microsoft SQL Server 2017 for x64-based Systems (CU31) 14.0.3006.16 before 14.0.3560.2
    • Microsoft SQL Server 2019 (GDR) 15.0.0 before 15.0.2200.2
    • Microsoft SQL Server 2019 for x64-based Systems (CU32) 15.0.4003.23 before 15.0.4500.2

    4 more entries in the full advisory.

    Source-reported fixed versions
    • KB5128496 (build 14.0.3560.2)
    • KB5128497 (build 14.0.2140.2)
    • KB5128495 (build 15.0.2200.2)
    • KB5126934 (build 16.0.4305.5)

    4 more entries in the full advisory.

    Mitigation guidance
    • Install the applicable security update for your platform: KB5128496, KB5128497, KB5128495, KB5126934, KB5128492, KB5126967 (see the Microsoft Update Catalog).
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-96956] SQL Server Elevation of Privilege Vulnerability

    CVE-2026-96956Source published Source updated

    SQL Server Elevation of Privilege Vulnerability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: dotnet10.0; and 2 more.

    Related products — impact not confirmed
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 8
    • Red Hat Enterprise Linux 9
    • Red Hat package: dotnet10.0

    2 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features