CVE-2025-59250: JDBC Driver for SQL Server Spoofing Vulnerability

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-14 · updated 2026-06-17
Weakness: CWE-20

Description

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

Affected products

Microsoft Jdbc Driver For Sql Server: from 10.2.0 before 10.2.4; from 11.2.0 before 11.2.4; from 12.2.0 before 12.2.1; from 12.4.0 before 12.4.3; from 12.6.0 before 12.6.5; from 12.8.0 before 12.8.2 — fixed in 10.2.4, 11.2.4, 12.10.2, 12.2.1, 12.4.3, 12.6.5
Microsoft JDBC Driver for SQL Server 10.2: from 1.0.0 before 10.2.4 — fixed in 10.2.4
Microsoft JDBC Driver for SQL Server 11.2: from 1.0.0 before 11.2.4 — fixed in 11.2.4
Microsoft JDBC Driver for SQL Server 12.10: from 1.0.0 before 12.10.2 — fixed in 12.10.2
Microsoft JDBC Driver for SQL Server 12.2: from 1.0.0 before 12.2.1 — fixed in 12.2.1
Microsoft JDBC Driver for SQL Server 12.4: from 1.0.0 before 12.4.3 — fixed in 12.4.3
Microsoft JDBC Driver for SQL Server 12.6: from 1.0.0 before 12.6.5 — fixed in 12.6.5
Microsoft JDBC Driver for SQL Server 12.8: from 1.0.0 before 12.8.2 — fixed in 12.8.2
Microsoft JDBC Driver for SQL Server 13.2: from 1.0.0 before 13.2.1 — fixed in 13.2.1

How to fix

Upgrade to a fixed version: Microsoft Jdbc Driver For Sql Server 10.2.4, 11.2.4, 12.10.2, 12.2.1; Microsoft JDBC Driver for SQL Server 10.2 10.2.4; Microsoft JDBC Driver for SQL Server 11.2 11.2.4; Microsoft JDBC Driver for SQL Server 12.10 12.10.2; Microsoft JDBC Driver for SQL Server 12.2 12.2.1; Microsoft JDBC Driver for SQL Server 12.4 12.4.3; Microsoft JDBC Driver for SQL Server 12.6 12.6.5; Microsoft JDBC Driver for SQL Server 12.8 12.8.2; Microsoft JDBC Driver for SQL Server 13.2 13.2.1. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250

Get alerted when CVE-2025-59250 or the next vulnerability affects your stack