Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · Catalog

   Detected

   Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

2. Oct 13, 2026 · Catalog

   Updated

   Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

Sources

• CVE.orgVulnerability recordCVE-2026-94520

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-94520

  30-day exploitation probability 0.6%

  first.org
• NIST NVDVulnerability recordCVE-2026-94520

  Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network.

  nvd.nist.gov

References

• Reference · msrc.microsoft.com