Microsoft · Security update · October 13, 2026
KB5128497: October 2026 security update
KB5128497, released October 13, 2026, fixes 12 CVEs in Microsoft SQL Server 2017 for x64-based Systems (GDR). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0084
58th percentile
Priority of the 12 CVEs
Patch now 0
Urgent 0
High 7
Routine 5
Applies to
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-85888 | SQL Server | Information Disclosure | 7.7 | 0.0080 | Exploitation Unlikely |
| High | CVE-2026-88081 | SQL Server | Information Disclosure | 7.7 | 0.0080 | Exploitation Unlikely |
| High | CVE-2026-94512 | SQL Server | Remote Code Execution | 8.8 | 0.0065 | Exploitation Unlikely |
| High | CVE-2026-96956 | SQL Server | Elevation of Privilege | 8.0 | 0.0059 | Exploitation Less Likely |
| High | CVE-2026-67625 | SQL Server | Remote Code Execution | 8.5 | 0.0056 | Exploitation Unlikely |
| High | CVE-2026-68883 | SQL Server | Elevation of Privilege | 8.5 | 0.0056 | Exploitation Less Likely |
| High | CVE-2026-85886 | SQL Server | Remote Code Execution | 8.5 | 0.0041 | Exploitation Unlikely |
| Routine | CVE-2026-94520 | SQL Server | Denial of Service | 4.9 | 0.0084 | Exploitation Unlikely |
| Routine | CVE-2026-67628 | SQL Server | Information Disclosure | 4.9 | 0.0080 | Exploitation Unlikely |
| Routine | CVE-2026-70189 | SQL Server | Remote Code Execution | 6.7 | 0.0033 | Exploitation Unlikely |
| Routine | CVE-2026-88089 | SQL Server | Remote Code Execution | 6.7 | 0.0030 | Exploitation Less Likely |
| Routine | CVE-2026-88085 | SQL Server | Elevation of Privilege | 6.4 | 0.0024 | Exploitation Unlikely |
Showing 1 to 12 of 12
1