NCSC-2026-0420

Vulnerability from csaf_ncscnl - Published: 2026-10-13 18:30 - Updated: 2026-10-13 18:30
Summary
Kwetsbaarheden verholpen in Microsoft SQL Server
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Microsoft heeft kwetsbaarheden verholpen in SQL Server.
Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren, mogelijk met rechten van de SQL server en toegang te krijgen tot gevoelige gegevens.
Oplossingen: Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op: https://portal.msrc.microsoft.com/en-us/security-guidance
Kans: medium
Schade: high
CWE-121: Stack-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-134: Use of Externally-Controlled Format String
CWE-190: Integer Overflow or Wraparound
CWE-416: Use After Free
CWE-502: Deserialization of Untrusted Data
CWE-770: Allocation of Resources Without Limits or Throttling
CVE-2026-65674

A deserialization vulnerability in SQL Server allows an authorized attacker to remotely execute code over a network by exploiting untrusted data processing.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Microsoft / Azure API Center
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2017 for x64-based Systems (GDR)
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2019 for x64-based Systems (GDR)
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2022 for x64-based Systems (CU 26)
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2022 for x64-based Systems (GDR)
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2025 for x64-based Systems (CU8)
 vers:unknown/*
vers:unknown/*
Microsoft / Microsoft SQL Server 2025 for x64-based Systems (GDR)
 vers:unknown/*
CVE-2026-67625

A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized attacker to remotely execute arbitrary code over a network.

Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-67626

An authorized attacker can exploit uncontrolled resource consumption in SQL Server to cause a denial of service over a network, impacting system availability.

Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-67628

An out-of-bounds read vulnerability in Microsoft SQL Server allows an authorized attacker to disclose sensitive information over a network, potentially compromising data confidentiality.

Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-68883

A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized remote attacker to elevate privileges over a network, posing a significant security risk.

Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-70189

A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized attacker to execute arbitrary code locally, posing a significant security risk.

Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-83945
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-85876
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-85886
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-85888
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-85919
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88081
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88082
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88083
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88084
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88085
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88086
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88088
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-88089
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-94512
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-94520
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
CVE-2026-96956
Affected products
Known affected 7 products, the same list as for CVE-2026-65674
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Microsoft heeft kwetsbaarheden verholpen in SQL Server.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren, mogelijk met rechten van de SQL server en toegang te krijgen tot gevoelige gegevens.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:\n\nhttps://portal.msrc.microsoft.com/en-us/security-guidance",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Use of Externally-Controlled Format String",
        "title": "CWE-134"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "title": "Kwetsbaarheden verholpen in Microsoft SQL Server",
    "tracking": {
      "current_release_date": "2026-10-13T18:30:52.078531Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0420",
      "initial_release_date": "2026-10-13T18:30:52.078531Z",
      "revision_history": [
        {
          "date": "2026-10-13T18:30:52.078531Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure API Center"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2017 for x64-based Systems (GDR)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2019 for x64-based Systems (GDR)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2022 for x64-based Systems (CU 26)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2022 for x64-based Systems (GDR)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2025 for x64-based Systems (CU8)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-7"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft SQL Server 2025 for x64-based Systems (GDR)"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65674",
      "notes": [
        {
          "category": "description",
          "text": "A deserialization vulnerability in SQL Server allows an authorized attacker to remotely execute code over a network by exploiting untrusted data processing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-65674 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65674.json"
        }
      ],
      "title": "CVE-2026-65674"
    },
    {
      "cve": "CVE-2026-67625",
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized attacker to remotely execute arbitrary code over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-67625 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67625.json"
        }
      ],
      "title": "CVE-2026-67625"
    },
    {
      "cve": "CVE-2026-67626",
      "notes": [
        {
          "category": "description",
          "text": "An authorized attacker can exploit uncontrolled resource consumption in SQL Server to cause a denial of service over a network, impacting system availability.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-67626 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67626.json"
        }
      ],
      "title": "CVE-2026-67626"
    },
    {
      "cve": "CVE-2026-67628",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability in Microsoft SQL Server allows an authorized attacker to disclose sensitive information over a network, potentially compromising data confidentiality.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-67628 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67628.json"
        }
      ],
      "title": "CVE-2026-67628"
    },
    {
      "cve": "CVE-2026-68883",
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized remote attacker to elevate privileges over a network, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-68883 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-68883.json"
        }
      ],
      "title": "CVE-2026-68883"
    },
    {
      "cve": "CVE-2026-70189",
      "notes": [
        {
          "category": "description",
          "text": "A heap-based buffer overflow vulnerability in Microsoft SQL Server allows an authorized attacker to execute arbitrary code locally, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-70189 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70189.json"
        }
      ],
      "title": "CVE-2026-70189"
    },
    {
      "cve": "CVE-2026-83945",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-83945 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83945.json"
        }
      ],
      "title": "CVE-2026-83945"
    },
    {
      "cve": "CVE-2026-85876",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85876 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85876.json"
        }
      ],
      "title": "CVE-2026-85876"
    },
    {
      "cve": "CVE-2026-85886",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85886 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85886.json"
        }
      ],
      "title": "CVE-2026-85886"
    },
    {
      "cve": "CVE-2026-85888",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85888 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85888.json"
        }
      ],
      "title": "CVE-2026-85888"
    },
    {
      "cve": "CVE-2026-85919",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85919 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85919.json"
        }
      ],
      "title": "CVE-2026-85919"
    },
    {
      "cve": "CVE-2026-88081",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88081 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88081.json"
        }
      ],
      "title": "CVE-2026-88081"
    },
    {
      "cve": "CVE-2026-88082",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88082 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88082.json"
        }
      ],
      "title": "CVE-2026-88082"
    },
    {
      "cve": "CVE-2026-88083",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88083 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88083.json"
        }
      ],
      "title": "CVE-2026-88083"
    },
    {
      "cve": "CVE-2026-88084",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88084 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88084.json"
        }
      ],
      "title": "CVE-2026-88084"
    },
    {
      "cve": "CVE-2026-88085",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88085 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88085.json"
        }
      ],
      "title": "CVE-2026-88085"
    },
    {
      "cve": "CVE-2026-88086",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88086 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88086.json"
        }
      ],
      "title": "CVE-2026-88086"
    },
    {
      "cve": "CVE-2026-88088",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88088 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88088.json"
        }
      ],
      "title": "CVE-2026-88088"
    },
    {
      "cve": "CVE-2026-88089",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-88089 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88089.json"
        }
      ],
      "title": "CVE-2026-88089"
    },
    {
      "cve": "CVE-2026-94512",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-94512 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94512.json"
        }
      ],
      "title": "CVE-2026-94512"
    },
    {
      "cve": "CVE-2026-94520",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-94520 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94520.json"
        }
      ],
      "title": "CVE-2026-94520"
    },
    {
      "cve": "CVE-2026-96956",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-96956 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96956.json"
        }
      ],
      "title": "CVE-2026-96956"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.