CVE-2026-70003: JDBC Driver for SQL Server Security Feature Bypass Vulnerability
CVE-2026-70003 is a security feature bypass vulnerability in JDBC Driver for SQL Server, rated Important by Microsoft, with a CVSS 3.1 base score of 8.7 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 1 product in 1 product family (SQL Server).
Key facts
- CVE ID
- CVE-2026-70003
- Severity
- High CVSS 8.7
- Microsoft severity
- Important
- Impact
- Security Feature Bypass
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- SQL Server
CVSS score and vector
Microsoft scores CVE-2026-70003 at 8.7 (temporal 7.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker who controls or can impersonate the SQL Server could replay a legitimate attestation response while substituting attacker-controlled key material during a client connection. Successful exploitation could allow the attacker to obtain column encryption keys and access or modify protected database data.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires Always Encrypted with secure enclaves to use HGS attestation. The attacker must also control or impersonate the SQL Server connection and have access to a legitimate attestation response that can be replayed.
What could an attacker accomplish by exploiting this vulnerability?
Successful exploitation could allow an attacker to bypass secure-enclave attestation, obtain column encryption keys, decrypt protected database data, and create modified encrypted data that the client accepts as valid.
Affected products (1)
SQL Server
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft JDBC Driver 13.4 for SQL Server | Release Notes | Security Update | 13.6.0 | Yes |
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |