CVE-2026-67383

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Microsoft SQL Server

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-67383

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	sql_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability in SQL Server involves an error message that unintentionally reveals sensitive information. An authorized attacker could exploit this over a network to gain access to confidential data.

Impact Analysis

If exploited, this flaw could allow attackers to access sensitive data stored in SQL Server databases. This may lead to data breaches, unauthorized access to personal or corporate information, and potential misuse of disclosed data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by exposing sensitive personal or health data. Organizations may face legal penalties, fines, or reputational damage due to data breaches.

Mitigation Strategies

Apply the latest security updates from Microsoft for SQL Server to address the information disclosure vulnerability. Ensure proper access controls are in place to limit authorized user privileges and monitor network traffic for unusual activity.

Hi! I’m here to help you understand CVE-2026-67383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70