CVE-2026-88084: Microsoft SQL Server 2019 For x64-Based Systems CU32

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.

Affected products

• Microsoft Microsoft SQL Server 2019 For x64-Based Systems CU32: from 15.0.4003.23, before 15.0.4500.2 (fixed in 15.0.4500.2)
• Microsoft Microsoft SQL Server 2019 Gdr: from 15.0.0, before 15.0.2200.2 (fixed in 15.0.2200.2)
• Microsoft Microsoft SQL Server 2025 CU8: affected versions not specified

Published 2026-10-13. Last modified 2026-10-15.