PatchSiren cyber security CVE debrief

CVE-2026-85919 Microsoft CVE debrief

Microsoft SQL Server Elevation of Privilege Vulnerability allows an authorized attacker to elevate privileges locally due to a heap-based buffer overflow. This vulnerability affects Microsoft SQL Server deployments, potentially allowing attackers to gain elevated access. Defenders should assess exposure and prioritize patching for affected versions. The CVE record and NVD entry provide details on the vulnerability, but do not specify exploitation or impact. Vendor advisories are available for affected versions.

Vendor: Microsoft
Product: Microsoft SQL Server 2019 (GDR)
CVSS: HIGH 7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-13
Original CVE updated: 2026-10-14
Advisory published: 2026-10-13
Advisory updated: 2026-10-14

Who should care

Defenders responsible for Microsoft SQL Server deployments should assess exposure and prioritize patching for affected versions. This includes reviewing inventory for vulnerable deployments, monitoring for potential exploitation attempts, and applying patches for Microsoft SQL Server versions 15.0.0 to 15.0.2200.1, 15.0.4003.23 to 15.0.4500.1, 16.0.0 to 16.0.1210.2, 16.0.4003.1 to 16.0.4305.4, and 17.0.4006.2 to 17.0

Why it matters

CVE-2026-85919 is a high-severity elevation of privilege vulnerability in Microsoft SQL Server, allowing authorized attackers to gain local privilege escalation. Defenders should prioritize verifying exposure and applying patches for affected versions.

Verify and apply patches for affected Microsoft SQL Server versions
Check inventory for vulnerable deployments
Monitor for potential exploitation attempts

Technical summary

The vulnerability is caused by a heap-based buffer overflow in Microsoft SQL Server, which allows an authorized attacker to elevate privileges locally. Affected versions include Microsoft SQL Server 2019 (GDR), 2019 for x64-based Systems (CU32), 2022 (GDR), 2022 for x64-based Systems (CU27), 2025 (CU8), 2025 for x64-based Systems (CU9), and 2025 for x64-based Systems (GDR).

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Microsoft SQL Server versions 15.0.0 to 15.0.2200.1, 15.0.4003.23 to 15.0.4500.1, 16.0.0 to 16.0.1210.2, 16.0.4003.1 to 16.0.4305.4, and 17.0.4006.2 to 17.0.5015.3.

Recommended defensive actions

Verify exposure by checking Microsoft SQL Server versions and applying patches
Review and update inventory for affected versions
Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify exploitation or impact. Vendor advisories are available for affected versions.

Sources and references

Verified primary and authoritative sources

CVE-2026-85919 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-85919

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-85919 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85919

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Microsoft SQL Server Elevation of Privilege Vulnerability
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85919.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85919

Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.