Microsoft · Security update · October 13, 2026

KB5128494: October 2026 security update

KB5128494, released October 13, 2026, fixes 19 CVEs in Microsoft SQL Server 2019 for x64-based Systems (CU32). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
19
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0162
76th percentile

Priority of the 19 CVEs

Patch now 0 Urgent 0 High 12 Routine 7

Applies to

Product
Microsoft SQL Server 2019 for x64-based Systems (CU32)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
High CVE-2026-65674 SQL Server Remote Code Execution 8.8 0.0162 Exploitation Less Likely
High CVE-2026-85888 SQL Server Information Disclosure 7.7 0.0080 Exploitation Unlikely
High CVE-2026-88081 SQL Server Information Disclosure 7.7 0.0080 Exploitation Unlikely
High CVE-2026-94512 SQL Server Remote Code Execution 8.8 0.0065 Exploitation Unlikely
High CVE-2026-96956 SQL Server Elevation of Privilege 8.0 0.0059 Exploitation Less Likely
High CVE-2026-67625 SQL Server Remote Code Execution 8.5 0.0056 Exploitation Unlikely
High CVE-2026-68883 SQL Server Elevation of Privilege 8.5 0.0056 Exploitation Less Likely
High CVE-2026-85886 SQL Server Remote Code Execution 8.5 0.0041 Exploitation Unlikely
High CVE-2026-85919 SQL Server Elevation of Privilege 7.0 0.0023 Exploitation Unlikely
High CVE-2026-88082 SQL Server Elevation of Privilege 7.0 0.0023 Exploitation Unlikely
High CVE-2026-88088 SQL Server Elevation of Privilege 7.0 0.0023 Exploitation Unlikely
High CVE-2026-85876 SQL Server Elevation of Privilege 7.0 0.0019 Exploitation Unlikely
Routine CVE-2026-94520 SQL Server Denial of Service 4.9 0.0084 Exploitation Unlikely
Routine CVE-2026-67628 SQL Server Information Disclosure 4.9 0.0080 Exploitation Unlikely
Routine CVE-2026-88084 SQL Server Denial of Service 5.3 0.0068 Exploitation Unlikely
Routine CVE-2026-88086 SQL Server Information Disclosure 5.3 0.0036 Exploitation Unlikely
Routine CVE-2026-70189 SQL Server Remote Code Execution 6.7 0.0033 Exploitation Unlikely
Routine CVE-2026-88089 SQL Server Remote Code Execution 6.7 0.0030 Exploitation Less Likely
Routine CVE-2026-88085 SQL Server Elevation of Privilege 6.4 0.0024 Exploitation Unlikely
Showing 1 to 19 of 19 1