CVE-2026-88084: SQL Server DOS Vulnerability

CVE-2026-88084 Overview

CVE-2026-88084 is a denial-of-service vulnerability in Microsoft SQL Server caused by allocation of resources without limits or throttling [CWE-770]. An authenticated attacker with low privileges can exhaust server resources over a network, causing availability loss. Microsoft published the advisory on October 13, 2026.

The flaw does not expose data or allow modification. It targets availability only, impacting database workloads and dependent applications. Exploitation requires network reachability to the SQL Server instance and valid credentials, which limits exposure to insiders or attackers who have obtained database accounts.

Critical Impact
An authenticated remote attacker can trigger resource exhaustion in SQL Server, taking the database service offline and disrupting dependent business applications.

Affected Products

Microsoft SQL Server (specific builds listed in the Microsoft advisory)
Applications and services dependent on the affected SQL Server instance
Environments permitting network connectivity to SQL Server from untrusted principals

Discovery Timeline

2026-10-13 - CVE-2026-88084 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-88084

Vulnerability Analysis

The vulnerability is classified under [CWE-770]: Allocation of Resources Without Limits or Throttling. SQL Server does not enforce sufficient bounds on a resource allocation path reachable by authenticated clients. An attacker who repeatedly invokes the affected code path can consume memory, CPU, worker threads, or other finite resources until the service becomes unresponsive.

The attack is executed over the network against SQL Server's listener. Successful exploitation requires low privileges on the target, meaning any legitimate database login may suffice depending on the surface. No user interaction is required, and the attack scope remains within the vulnerable component.

Attack complexity is high because the attacker must satisfy conditions beyond the attacker's direct control, such as timing or specific server state, to reliably trigger exhaustion. The impact is restricted to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is missing throttling or quota enforcement on a server-side resource allocation. When the affected request type is processed, SQL Server allocates resources proportional to attacker-controlled input without applying rate limits, memory caps, or connection-level ceilings. Repeated or crafted requests accumulate resource usage until the engine can no longer service legitimate queries.

Attack Vector

The attacker authenticates to the SQL Server instance over the network using any valid low-privileged credential. The attacker then issues a sequence of requests targeting the vulnerable allocation path. As the server allocates resources without throttling, memory and worker thread pools are depleted, causing new connections and queries to fail. The vulnerability is described in prose only; refer to the Microsoft Vulnerability Advisory CVE-2026-88084 for build-specific technical detail.

Detection Methods for CVE-2026-88084

Indicators of Compromise

Sudden spikes in SQL Server memory consumption, worker thread usage, or RESOURCE_SEMAPHORE waits without a corresponding business workload.
Repeated connections or queries from a single low-privileged login immediately preceding availability loss.
SQL Server error log entries indicating memory pressure, failed memory allocations, or dropped connections.

Detection Strategies

Baseline normal SQL Server resource utilization and alert on deviations in worker thread count, memory grants, and sys.dm_os_wait_stats pressure indicators.
Correlate authentication events with resource spikes using database audit logs to identify the originating login and client address.
Monitor SQL Server endpoints for anomalous query volume or payload patterns from accounts that normally issue limited workloads.

Monitoring Recommendations

Enable SQL Server extended events or audit specifications on login activity and query execution patterns for sensitive instances.
Forward SQL Server logs and host telemetry to a centralized analytics platform to detect multi-stage resource exhaustion attempts.
Track service availability using synthetic health checks that alert immediately when the database stops responding to queries.

How to Mitigate CVE-2026-88084

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-88084 to all affected SQL Server builds.
Inventory SQL Server instances reachable from untrusted network segments and prioritize patching for internet-exposed or multi-tenant systems.
Review and revoke unused or over-provisioned database logins to reduce the pool of accounts that could be abused.

Patch Information

Microsoft has published build-specific patches through the Microsoft Security Response Center. Administrators should consult the Microsoft Vulnerability Advisory CVE-2026-88084 to identify the correct cumulative update or security update for each deployed SQL Server version and install it following standard change-management procedures.

Workarounds

Restrict network access to SQL Server using firewall rules, network segmentation, or private endpoints so only trusted application tiers can reach the listener.
Apply Resource Governor workload groups to cap memory, CPU, and request limits for lower-trust logins while patching is scheduled.
Enforce connection and query throttling at the application tier to limit the volume of requests any single authenticated principal can send.

bash

# Example: constrain a low-trust login with Resource Governor
# Review and adapt before applying in production
CREATE WORKLOAD GROUP low_trust_grp
    WITH (REQUEST_MAX_MEMORY_GRANT_PERCENT = 5,
          REQUEST_MAX_CPU_TIME_SEC = 10,
          MAX_DOP = 1,
          GROUP_MAX_REQUESTS = 20)
    USING default;
ALTER RESOURCE GOVERNOR RECONFIGURE;