Microsoft Critical SQL Server and Windows Vulnerabilities

Overview

• CVE: CVE-2026-65669, CVE-2026-68839, CVE-2026-69276

• Severity: Critical

• Date: 10 September 2026

• Products: SQL Server Management Studio 22 and Windows 10 Version 1607

Microsoft has published security updates for three vulnerabilities rated Critical by CVSS affecting SQL Server Management Studio 22 and Windows 10 Version 1607. Microsoft assigns an Important maximum severity to the two Windows flaws and Critical severity to the SQL Server Management Studio flaw. Organisations should deploy the applicable updates promptly.

Affected Versions

SQL Server Management Studio 22 - CVE-2026-65669

• Affected: The vendor has not specified an exact affected-version range as of 10 September 2026.

• Fixed: SQL Server Management Studio 22.8.2.

• Not affected: Microsoft has not specified unaffected versions or configurations.

• Source: Microsoft CVE-2026-65669 advisory

• Release notes: SQL Server Management Studio 22 release notes

Windows 10 Version 1607 - CVE-2026-68839 and CVE-2026-69276

• Affected: Windows 10 Version 1607 for 32-bit and x64-based systems. The vendor has not specified an exact affected-build range as of 10 September 2026.

• Fixed: KB5123099, OS Build 14393.9512.

• Not affected: Microsoft has not specified unaffected versions or configurations for this product scope.

• Sources: Microsoft CVE-2026-68839 advisory and Microsoft CVE-2026-69276 advisory

• Patch notice: Microsoft KB5123099, OS Build 14393.9512

  
  

Vulnerability Breakdown

CVE-2026-68839 – Windows USB Mass Storage Class Driver Remote Code Execution

• Severity: Critical by CVSS score. Microsoft maximum severity: Important.

• CVSS: 9.8

• Description: A heap-based buffer overflow and improper input validation flaw in the Windows USB Mass Storage Class Driver could allow code execution over a network.

• Impact: Remote code execution with high potential impact to confidentiality, integrity and availability.

• Conditions: The attacker must be in-network. No privileges or user interaction are required.

• Exploit status: Not publicly disclosed or known to be exploited at publication. Microsoft assessed exploitation as less likely.

• Source: Microsoft CVE-2026-68839 advisory

CVE-2026-69276 – Microsoft UxTheme Library Remote Code Execution

• Severity: Critical by CVSS score. Microsoft maximum severity: Important.

• CVSS: 9.8

• Description: An integer underflow and heap-based buffer overflow in the Microsoft UxTheme Library could allow code execution over a network.

• Impact: Remote code execution with high potential impact to confidentiality, integrity and availability.

• Conditions: The attacker must be in-network. No privileges or user interaction are required.

• Exploit status: Not publicly disclosed or known to be exploited at publication. Microsoft assessed exploitation as unlikely.

• Source: Microsoft CVE-2026-69276 advisory

CVE-2026-65669 – Microsoft SQL Server Elevation of Privilege

• Severity: Critical

• CVSS: 9.6

• Description: Improper neutralisation of special elements in output used by a downstream component could allow an attacker to bypass intended SQL Copilot read-only restrictions.

• Impact: Database data could be accessed or modified using the connected user's permissions.

• Conditions: No prior privileges are required, but the attacker must convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio.

• Exploit status: Not publicly disclosed or known to be exploited at publication. Microsoft assessed exploitation as less likely.

• Source: Microsoft CVE-2026-65669 advisory

  
  

Mitigation

• Update SQL Server Management Studio 22 to version 22.8.2 or later using the Microsoft SSMS security update.

• Apply KB5123099 to Windows 10 Version 1607 systems and confirm the OS build is 14393.9512.

• Install the latest servicing stack update, KB5122874, before KB5123099 where required.

• Use Windows Update, Windows Update for Business, Microsoft Update Catalog or Windows Server Update Services to deploy the Windows update.

• Prioritise internet-facing, highly privileged and business-critical systems, then verify successful installation through patch reporting.

  
  

Summary for IT Teams

• Products: Microsoft SQL Server Management Studio 22 and Windows 10 Version 1607

• Threat Level: Critical, CVSS 9.8, 9.8 and 9.6

• Action Required: Update SSMS to 22.8.2 or later and deploy KB5123099 to Windows 10 Version 1607. Confirm the Windows build is 14393.9512.