SB20261111130 - Improper Verification of Cryptographic Signature in JDBC Driver for SQL Server

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-70003)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass secure-enclave attestation, obtain column encryption keys, decrypt protected database data, and create modified encrypted data that the client accepts as valid.

The vulnerability exists due to improper verification of cryptographic signatures in JDBC Driver for SQL Server when handling secure-enclave attestation during a client connection. A remote attacker can control or impersonate the SQL Server connection and replay a legitimate attestation response while substituting attacker-controlled key material to obtain column encryption keys and access or modify protected database data.

Successful exploitation requires Always Encrypted with secure enclaves to use HGS attestation.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70003
• https://learn.microsoft.com/en-us/sql/connect/jdbc/download-microsoft-jdbc-driver-for-sql-server?view=sql-server-ver17