Microsoft SQL Server (September 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344798);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/11");

  script_cve_id(
    "CVE-2026-47297",
    "CVE-2026-66814",
    "CVE-2026-66816",
    "CVE-2026-66818",
    "CVE-2026-66819",
    "CVE-2026-66820",
    "CVE-2026-67368",
    "CVE-2026-67369",
    "CVE-2026-67370",
    "CVE-2026-67373",
    "CVE-2026-67376",
    "CVE-2026-67378",
    "CVE-2026-67379",
    "CVE-2026-67380",
    "CVE-2026-67381",
    "CVE-2026-67383",
    "CVE-2026-67384",
    "CVE-2026-67385",
    "CVE-2026-67386",
    "CVE-2026-67388",
    "CVE-2026-67389",
    "CVE-2026-67390",
    "CVE-2026-67393",
    "CVE-2026-67624",
    "CVE-2026-67629",
    "CVE-2026-67630",
    "CVE-2026-67631",
    "CVE-2026-67633",
    "CVE-2026-67636",
    "CVE-2026-67638",
    "CVE-2026-67639",
    "CVE-2026-67641",
    "CVE-2026-67642",
    "CVE-2026-67643",
    "CVE-2026-67645",
    "CVE-2026-67648",
    "CVE-2026-68775",
    "CVE-2026-68776",
    "CVE-2026-68777",
    "CVE-2026-68778",
    "CVE-2026-68779",
    "CVE-2026-68780",
    "CVE-2026-68781",
    "CVE-2026-68784",
    "CVE-2026-68785",
    "CVE-2026-68786",
    "CVE-2026-68787",
    "CVE-2026-69562",
    "CVE-2026-73028",
    "CVE-2026-73029",
    "CVE-2026-77480",
    "CVE-2026-77481",
    "CVE-2026-77482",
    "CVE-2026-77483",
    "CVE-2026-77484",
    "CVE-2026-77485",
    "CVE-2026-77486",
    "CVE-2026-77487",
    "CVE-2026-77488",
    "CVE-2026-78441",
    "CVE-2026-78442",
    "CVE-2026-78456"
  );
  script_xref(name:"MSKB", value:"5122768");
  script_xref(name:"MSKB", value:"5122769");
  script_xref(name:"MSKB", value:"5122770");
  script_xref(name:"MSKB", value:"5122771");
  script_xref(name:"MSKB", value:"5122772");
  script_xref(name:"MSKB", value:"5122773");
  script_xref(name:"MSKB", value:"5122774");
  script_xref(name:"MSKB", value:"5122775");
  script_xref(name:"MSFT", value:"MS26-5122768");
  script_xref(name:"MSFT", value:"MS26-5122769");
  script_xref(name:"MSFT", value:"MS26-5122770");
  script_xref(name:"MSFT", value:"MS26-5122771");
  script_xref(name:"MSFT", value:"MS26-5122772");
  script_xref(name:"MSFT", value:"MS26-5122773");
  script_xref(name:"MSFT", value:"MS26-5122774");
  script_xref(name:"MSFT", value:"MS26-5122775");

  script_name(english:"Microsoft SQL Server (September 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft SQL Server installation on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft SQL Server installation on the remote host is missing security updates. It is,
therefore, affected by multiple vulnerabilities:

  - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
    (CVE-2026-77482)

  - Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a
    network. (CVE-2026-77486)

  - Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a
    network. (CVE-2026-78442)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122768");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122769");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122770");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122771");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122772");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122773");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122774");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5122775");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released the following security updates to address this issue:
  -KB5122768
  -KB5122769
  -KB5122770
  -KB5122771
  -KB5122772
  -KB5122773
  -KB5122774
  -KB5122775");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-77482");
  script_cwe_id(59, 89, 121, 122, 125, 126, 190, 191, 209, 269, 284, 416, 502, 778, 822, 908, 1220, 1390);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sql_server");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl", "mssql_version.nasl", "smb_enum_services.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 1433, "Services/mssql", "Host/patch_management_checks");

  exit(0);
}

include('vcf_extras_microsoft.inc');

var app_info = vcf::microsoft::mssql::get_app_info();

var constraints = [
  {
    'product_version' : '2016',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2016.130.6300.2',
    'fixed_version'   : '2016.130.6500.1',
    'kb'              : '5102340'
  },
  {
    'product_version' : '2016',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2016.130.7000.253',
    'fixed_version'   : '2016.130.7095.1',
    'kb'              : '5102339'
  },
  {
    'product_version' : '2017',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2017.140.1000.169',
    'fixed_version'   : '2017.140.2130.4',
    'kb'              : '5122775'
  },
  {
    'product_version' : '2017',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2017.140.3006.16',
    'fixed_version'   : '2017.140.3550.4',
    'kb'              : '5122774'
  },
  {
    'product_version' : '2019',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2019.150.2000.5',
    'fixed_version'   : '2019.150.2190.7',
    'kb'              : '5122773'
  },
  {
    'product_version' : '2019',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2019.150.4003.23',
    'fixed_version'   : '2019.150.4490.9',
    'kb'              : '5122772'
  },
  {
    'product_version' : '2022',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2022.160.1000.6',
    'fixed_version'   : '2022.160.1200.5',
    'kb'              : '5122771'
  },
  {
    'product_version' : '2022',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2022.160.4003.1',
    'fixed_version'   : '2022.160.4275.2',
    'kb'              : '5122768'
  },
  {
    'product_version' : '2025',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2025.170.1000.7',
    'fixed_version'   : '2025.170.1135.8',
    'kb'              : '5122770'
  },
  {
    'product_version' : '2025',
    'target_hw'       : 'x64',
    'file'            : 'sqlservr.exe',
    'min_version'     : '2025.170.4006.2',
    'fixed_version'   : '2025.170.4085.5',
    'kb'              : '5122769'
  }
];

vcf::microsoft::mssql::check_version_and_report(
  app_info          : app_info,
  constraints       : constraints,
  bulletin          : 'MS26-09',
  severity          : SECURITY_HOLE
);