Microsoft SQL Server: Information disclosure via weak cryptographic algorithm
Summary
Microsoft SQL Server contains a use of a broken or risky cryptographic algorithm (CWE-327). An unauthenticated attacker on the network can disclose information, under high attack complexity. Microsoft does not state which algorithm or protocol is affected. Integrity and availability are not impacted.
Affected
- SQL Server 2017 GDR: 14.0.0 to before 14.0.2150.2
- SQL Server 2017 CU31: 14.0.3006.16 to before 14.0.3570.2
- SQL Server 2019 GDR: 15.0.0 to before 15.0.2210.4
- SQL Server 2019 CU32: 15.0.4003.23 to before 15.0.4510.2
- SQL Server 2022 GDR: 16.0.0 to before 16.0.1220.3
- SQL Server 2022 CU27: 16.0.4003.1 to before 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to before 17.0.5045.3
- SQL Server 2025 GDR: 17.0.1050.2 to before 17.0.1155.3
Fixed in
- SQL Server 2017 GDR: 14.0.2150.2 (KB5132749)
- SQL Server 2017 CU31 + GDR: 14.0.3570.2 (KB5132746)
- SQL Server 2019 GDR: 15.0.2210.4 (KB5132751)
- SQL Server 2019 CU32 + GDR: 15.0.4510.2 (KB5132745)
- SQL Server 2022 GDR: 16.0.1220.3 (per CVE record range; KB number unknown)
- SQL Server 2022 CU27 + GDR: 16.0.4315.2 (KB5129300)
- SQL Server 2025 CU10 + GDR: 17.0.5045.3 (KB5129299)
- SQL Server 2025 GDR: 17.0.1155.3 (KB5132748)
Workaround
Unknown. No workaround or mitigation is documented in the sources. Apply the vendor update.
Exploitation
- No confirmed exploitation in the wild (Rapid7, November 2026).
- CISA SSVC: exploitation none, not automatable.
- Microsoft rates exploit maturity as Unproven (E:U).
- No public proof-of-concept found.
Our recommendation
- Patch SQL Server instances to the fixed builds in the November 2026 update, applying the whole bundle.
- Prioritise instances that are internet-facing or reachable from less-trusted networks.
- Restrict network access to SQL Server (default TCP 1433) to required application servers only.
- Verify your SQL Server versions against the affected list, since the support lifecycle of older branches should be checked with Microsoft.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118102 msrc.microsoft.com
- CVE.org record CVE-2026-118102 www.cve.org
- KB5132749: SQL Server 2017 GDR, November 2026 support.microsoft.com
- KB5132746: SQL Server 2017 CU31 + GDR, November 2026 support.microsoft.com
- KB5132745: SQL Server 2019 CU32 + GDR, November 2026 support.microsoft.com
- KB5129300: SQL Server 2022 CU27 + GDR, November 2026 support.microsoft.com
- KB5129299: SQL Server 2025 CU10 + GDR, November 2026 support.microsoft.com
- Rapid7: Patch Tuesday, November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:18.
Original description (NVD)
Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.