Microsoft.Data.SqlClient: Authentication bypass by capture-replay
Summary
The .NET data provider Microsoft.Data.SqlClient, used by applications to connect to SQL Server, contains an authentication bypass based on capture-replay (CWE-294). An attacker who can observe and replay network traffic between an affected application and the database may be able to disclose information. The attacker needs to be on the traffic path, for example on the internal network, and the attack is rated as high complexity; the flaw does not directly expose an internet-facing SQL Server.
Affected
- Microsoft.Data.SqlClient 6.1 before 6.1.7
- Microsoft.Data.SqlClient 7.0 before 7.0.3
- Microsoft.Data.SqlClient 7.1 before 7.1.0-preview3
Fixed in
- Microsoft.Data.SqlClient 6.1.7
- Microsoft.Data.SqlClient 7.0.3
- Microsoft.Data.SqlClient 7.1.0-preview3 (a stable 7.1 release is likely the better target; verify on MSRC or NuGet)
- Update companion packages to 7.0.3 as well, per the release notes.
Workaround
Unknown.
Exploitation
- Known in the wild: no evidence found; not verified against the CISA KEV catalog.
- Microsoft's CVSS vector rates exploit maturity as proof-of-concept (E:P).
- An unconfirmed aggregator claims a public exploit is available.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory .NET applications referencing Microsoft.Data.SqlClient, including transitive references and companion packages.
- Upgrade to 6.1.7, 7.0.3 or a stable 7.1 release containing the fix, then rebuild and redeploy the applications.
- Prioritise applications used over untrusted or shared networks and those handling sensitive personal data.
- Check the MSRC advisory for additional guidance and re-check it, as the information is very recent.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-62903 msrc.microsoft.com
- CVE Record (CNA: Microsoft) www.cve.org
- dotnet/sqlclient release notes github.com
- Microsoft Tech Community: SqlClient security updates (2024) techcommunity.microsoft.com
- CWE-294 definition (MITRE) cwe.mitre.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:17.
Original description (NVD)
Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.