Security
CVE detail from Microsoft's public MSRC CVRF API, cross-checked with CISA's Known Exploited Vulnerabilities catalog. Counts cover Microsoft-issued CVEs; republished third-party CVEs such as Chromium or Linux are hidden unless you include them.
Fixed by KB5128494Clear
| CVE | Vulnerability | Severity | CVSS | Impact | Status | Fixed by |
|---|---|---|---|---|---|---|
| CVE-2026-70189 | Microsoft SQL Server Remote Code Execution VulnerabilitySQL Server | Important | 6.7 | RCELocal | KB5126934KB5126967+6 | |
| CVE-2026-88089 | Microsoft SQL Server Remote Code Execution VulnerabilitySQL Server | Important | 6.7 | RCELocal | KB5126934KB5126967+6 | |
| CVE-2026-88085 | Microsoft SQL Server Elevation of Privilege VulnerabilitySQL Server | Important | 6.4 | EoPLocal | KB5126934KB5126967+6 | |
| CVE-2026-88084 | Microsoft SQL Server Denial of Service VulnerabilitySQL Server | Important | 5.3 | DoSNetwork | KB5128494KB5128495 | |
| CVE-2026-88086 | Microsoft SQL Server Information Disclosure VulnerabilitySQL Server | Important | 5.3 | Information DisclosureAdjacent | KB5126934KB5126967+4 | |
| CVE-2026-67628 | Microsoft SQL Server Information Disclosure VulnerabilitySQL Server | Important | 4.9 | Information DisclosureNetwork | KB5126934KB5126967+6 | |
| CVE-2026-94520 | Microsoft SQL Server Denial of Service VulnerabilitySQL Server | Important | 4.9 | DoSNetwork | KB5126934KB5126967+6 |
Advisories
MSRC guidance without a CVE of its own · 1 advisory
Hardening changes for ReFS volumes on removable mediaStarting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the Resilient File System (ReFS) . This change is not enable by default until 2027. Please see Hardening changes for ReFS volumes on removable media for more information.