Microsoft update

KB5089271

Security Update

Fixed in

Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR) 13.0.6490.1

TI-2026-29145 CVE-2026-40370 · GHSA-c4mg-2cmw-c72r

MEDIUM 41

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00555 Published 2026-05-12 Fixed in 13.0.6490.1, 13.0.7085.1 +8 CWE-73