Authentication Bypass by Capture-replay in Microsoft.Data.SqlClient - CVE-2026-62903
Published: November 11, 2026
Vulnerability identifier: #VU165708
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62903
CWE-ID: CWE-294
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain encryption keys and read the plaintext of database columns protected by Always Encrypted with secure enclaves.
The vulnerability exists due to authentication bypass by capture-replay in SQL Server when handling authentication exchanges. A remote attacker can position themselves in the logical network path between the target and the resource requested by the victim and replay captured authentication data to obtain encryption keys protecting sensitive database information.
Affected software
Microsoft.Data.SqlClient
How to mitigate CVE-2026-62903
Install security update from vendor's website.
Microsoft.Data.SqlClient - addressed in versions 6.1.7, 7.0.3, 7.1.0-preview3