---
id: "CVE-2026-62903"
page: "https://infrastack.ai/live/CVE-2026-62903"
kind: "vulnerability"
aliases: ["CVE-2026-62903"]
title: "Microsoft.Data.SqlClient: capture-replay authentication bypass can disclose information over the network"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft.Data.SqlClient", "fixed": ["6.1.7", "7.0.3", "7.1.0-preview3"], "affected": "< 6.1.7 (6.1 line); < 7.0.3 (7.0 line); < 7.1.0-preview3 (7.1 line)", "ecosystem": "nuget"}]
ecosystems: []
tags: ["client-driver", "database", "dotnet", "nuget", "runtime", "sql-server", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:17+00:00"
first_seen_at: "2026-11-10T19:25:16+00:00"
updated_at: "2026-11-10T21:22:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62903", "first_seen_at": "2026-11-10T19:25:16+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-62903", "first_seen_at": "2026-11-10T21:22:42+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-62903", "https://github.com/dotnet/SqlClient/releases/tag/v7.0.3", "https://github.com/dotnet/SqlClient/blob/main/release-notes/6.1/6.1.7.md"]}]
exploit_sources: []
---

# Microsoft.Data.SqlClient: capture-replay authentication bypass can disclose information over the network

Link for people: https://infrastack.ai/live/CVE-2026-62903 (this .md is for agents)

The CVE text says SQL Server, but the CNA data (Microsoft, via OpenCVE) lists the Microsoft.Data.SqlClient .NET driver (CWE-294, capture-replay) as the affected product, not the SQL Server engine. An unauthenticated network attacker with high complexity could replay captured authentication traffic and disclose information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Microsoft.Data.SqlClient affected < 6.1.7 (6.1 line); < 7.0.3 (7.0 line); < 7.1.0-preview3 (7.1 line) fixed 6.1.7, 7.0.3, 7.1.0-preview3

## How to check

Look in your project files and lock files (*.csproj, packages.lock.json, Directory.Packages.props) for Microsoft.Data.SqlClient, or run 'dotnet list package --include-transitive'. You are exposed if the version is below 6.1.7 (6.1 line), below 7.0.3 (7.0 line) or below 7.1.0-preview3 (7.1 line). Source: third-party aggregator of the CNA data; not confirmed on the MSRC page.

## Fix

Upgrade Microsoft.Data.SqlClient to 6.1.7, 7.0.3, or a stable 7.1 release (7.1.1 is the latest listed on Microsoft Learn). The release notes I read do not name this CVE, so the mapping of fix to CVE comes from the version bounds only.

## Timeline

- 2026-11-10T19:25:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62903
- 2026-11-10T21:22:42+00:00 analyst https://app.opencve.io/cve/CVE-2026-62903 — NVD page was empty and MSRC page unreadable. Affected product is Microsoft.Data.SqlClient, not the SQL Server engine; the title was wrong and is rewritten. Versions come from OpenCVE (CNA data) and are not confirmed against the MSRC page, so nothing is marked verified. Not exploited, no PoC found.

## Documents

- [describes] OpenCVE: CVE-2026-62903 Microsoft.Data.SqlClient Information Disclosure (CNA data) https://app.opencve.io/cve/CVE-2026-62903
- [mentions] SqlClient v7.0.3 https://github.com/dotnet/SqlClient/releases/tag/v7.0.3
- [mentions] SqlClient 6.1.7 release notes https://github.com/dotnet/SqlClient/blob/main/release-notes/6.1/6.1.7.md

## From the sources

Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_