{"id":"CVE-2026-68783","kind":"vulnerability","aliases":["CVE-2026-68783"],"related":[],"title":"Microsoft SQL Server: uninitialized memory lets an authorized user read data","description":"Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.","summary":"SQL Server reads a resource that was never initialized, which can leak information to an attacker. The attacker must already hold valid credentials and can reach the server over the network.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft","self-hosted","sql-server","vendor"],"not_affected_if":["auth-required","no-network-access"],"how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION` and compare it to the fixed build in the vendor advisory","fix":null,"status":"open","published_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:56:11+00:00","updated_at":"2026-11-10T19:56:11+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:56:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: uninitialized memory lets an authorized user read data","impact":"low","summary":"SQL Server reads a resource that was never initialized, which can leak information to an attacker. The attacker must already hold valid credentials and can reach the server over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user reads uninitialized server memory, possibly secrets","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-68783 for affected builds, fixed versions and the update to install.","how_to_check":"- Check the installed SQL Server build with `SELECT @@VERSION` and compare it to the fixed build in the vendor advisory\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-network-access","auth-required"],"who_is_affected":"Organizations running Microsoft SQL Server where users hold database logins reachable over the network. The sources do not list affected builds or the fixed version. Servers that accept no network logins from untrusted users are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4483,"output_tokens":474,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68783':14A,17A 'allow':64C 'alreadi':45B 'attack':41B,43B,67C 'author':8A,66C 'credenti':48B 'cve':12A,15A 'data':11A 'disclos':69C 'hold':46B 'host':21B 'inform':38B,70C 'initi':34B 'leak':37B 'let':6A 'memori':5A 'microsoft':1A,18B 'must':44B 'network':56B,73C 'never':33B 'reach':51B 'read':10A,28B 'resourc':30B,60C 'self':20B 'self-host':19B 'server':3A,24B,27B,53B,63C 'sql':2A,23B,26B,62C 'sql-server':22B 'uniniti':4A,59C 'use':57C 'user':9A 'valid':47B 'vendor':25B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where users hold database logins reachable over the network. The sources do not list affected builds or the fixed version. Servers that accept no network logins from untrusted users are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","microsoft","selfhosted","sqlserver","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-68783':14A,17A 'author':8A 'cve':12A,15A 'data':11A 'let':6A 'memori':5A 'microsoft':1A 'read':10A 'server':3A 'sql':2A 'uniniti':4A 'user':9A","search_b":"'alreadi':45B 'attack':41B,43B 'credenti':48B 'hold':46B 'host':21B 'inform':38B 'initi':34B 'leak':37B 'microsoft':18B 'must':44B 'network':56B 'never':33B 'reach':51B 'read':28B 'resourc':30B 'self':20B 'self-host':19B 'server':24B,27B,53B 'sql':23B,26B 'sql-server':22B 'valid':47B 'vendor':25B","search_c":"'allow':64C 'attack':67C 'author':66C 'disclos':69C 'inform':70C 'network':73C 'resourc':60C 'server':63C 'sql':62C 'uniniti':59C 'use':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68783","severity":null,"published_at":"2026-11-10T19:21:19+00:00","modified_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}