CVE-2024-0056: Microsoft .net

High severity, CVSS 8.7. EPSS: 1.2% chance of exploitation in the next 30 days.

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Affected products

• Microsoft .net: from 6.0.0, before 6.0.26 (fixed in 6.0.26); from 7.0.0, before 7.0.15 (fixed in 7.0.15); version 8.0.0 only
• Microsoft .NET Framework: from 4.8, before 4.8.04690.02 (fixed in 4.8.04690.02); from 4.8, before 4.8.04690.01 (fixed in 4.8.04690.01); version 4.6.2 only; version 4.7 only; version 4.7.1 only; version 4.7.2 only; …
• Microsoft Microsoft.data.sqlclient: from 2.1, before 2.1.7 (fixed in 2.1.7); from 3.1, before 3.1.5 (fixed in 3.1.5); from 4.0, before 4.0.5 (fixed in 4.0.5); from 5.1, before 5.1.3 (fixed in 5.1.3)
• Microsoft SQL Server: version 2022 only
• Microsoft System.data.sqlclient: before 4.8.6 (fixed in 4.8.6)
• Microsoft Visual Studio 2022: from 17.2, before 17.2.23 (fixed in 17.2.23); from 17.4, before 17.4.15 (fixed in 17.4.15); from 17.6, before 17.6.11 (fixed in 17.6.11); from 17.8, before 17.8.4 (fixed in 17.8.4)

Published 2024-01-09. Last modified 2026-06-17.