SB20261111128 - Authentication Bypass by Capture-replay in Microsoft.Data.SqlClient

Description

This security bulletin contains information about 1 vulnerability.

1) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-62903)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain encryption keys and read the plaintext of database columns protected by Always Encrypted with secure enclaves.

The vulnerability exists due to authentication bypass by capture-replay in SQL Server when handling authentication exchanges. A remote attacker can position themselves in the logical network path between the target and the resource requested by the victim and replay captured authentication data to obtain encryption keys protecting sensitive database information.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-62903
• https://github.com/dotnet/SqlClient/releases#release-v6.1.7