Security Updates for Microsoft SQL Server (May 2026)

high Nessus Plugin ID 314668

Synopsis

The Microsoft SQL Server installation on the remote host is missing a security update.

Description

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

- External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. (CVE-2026-40370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Microsoft has released the following security updates to address this issue:
-KB5089270
-KB5089271
-KB5089899
-KB5089900
-KB5090347
-KB5090354
-KB5090407
-KB5090408
-KB5091158
-KB5091223

Plugin Details

Severity: High

ID: 314668

File Name: smb_nt_ms26_may_mssql.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows : Microsoft Bulletins

Published: 5/14/2026

Updated: 5/14/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-40370

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:sql_server

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Patch Publication Date: 5/12/2026

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-40370

MSFT: MS26-5089270, MS26-5089271, MS26-5089899, MS26-5089900, MS26-5090347, MS26-5090354, MS26-5090407, MS26-5090408, MS26-5091158, MS26-5091223

MSKB: 5089270, 5089271, 5089899, 5089900, 5090347, 5090354, 5090407, 5090408, 5091158, 5091223

Detections

Analytics