CVE-2025-59250VulnerabilityPublished 10/14/2025Updated 02/26/2026

CVE-2025-59250: CWE-20: Improper Input Validation in Microsoft Microsoft JDBC Driver for SQL Server 10.2

Affects Microsoft Microsoft JDBC Driver for SQL Server 10.2Source CVE Database V5

Not known to be exploited · CVSS 8.1 High.

Data as of 10/25/2026, 04:40:10 UTC

CVSS 3.1 base score

8.1High

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Base metrics

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Temporal metrics

Exploit Code Maturity: Unproven
Remediation Level: Official Fix
Report Confidence: Confirmed

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.
Exploit Code Maturity: Unproven: No exploit code is available, or an exploit is theoretical.
Remediation Level: Official Fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Report Confidence: Confirmed: Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
MicrosoftMicrosoft JDBC Driver for SQL Server 10.2	Affected >=1.0.0 <10.2.4	Fixed in 10.2.4
MicrosoftMicrosoft JDBC Driver for SQL Server 11.2	Affected >=1.0.0 <11.2.4	Fixed in 11.2.4
MicrosoftMicrosoft JDBC Driver for SQL Server 12.10	Affected >=1.0.0 <12.10.2	Fixed in 12.10.2
MicrosoftMicrosoft JDBC Driver for SQL Server 12.2	Affected >=1.0.0 <12.2.1	Fixed in 12.2.1
MicrosoftMicrosoft JDBC Driver for SQL Server 12.4	Affected >=1.0.0 <12.4.3	Fixed in 12.4.3
MicrosoftMicrosoft JDBC Driver for SQL Server 12.6	Affected >=1.0.0 <12.6.5	Fixed in 12.6.5
MicrosoftMicrosoft JDBC Driver for SQL Server 12.8	Affected >=1.0.0 <12.8.2	Fixed in 12.8.2
MicrosoftMicrosoft JDBC Driver for SQL Server 13.2	Affected >=1.0.0 <13.2.1	Fixed in 13.2.1

AI-suggested

1. Monitor official Microsoft channels for patches or updates addressing CVE-2025-59250 and apply them promptly once available. 2. Implement strict input validation and sanitization on all data sent to the JDBC driver to reduce the risk of malformed input triggering the vulnerability. 3. Employ network-level protections such as TLS encryption for SQL Server connections to prevent interception and spoofing attacks. 4. Use network segmentation and firewall rules to restrict access to SQL Server instances only to trusted hosts and applications. 5. Enable and review detailed logging on database servers and client applications to detect unusual connection patterns or authentication anomalies. 6. Educate developers and administrators about the risks of improper input validation and encourage secure coding practices when interacting with database drivers. 7. Consider deploying intrusion detection/prevention systems (IDS/IPS) capable of identifying spoofing or man-in-the-middle attack signatures in network traffic. 8. Where feasible, limit user interaction that triggers database connections or implement multi-factor authentication to reduce exploitation likelihood. 9. Conduct regular security assessments and penetration testing focused on database connectivity components to identify and remediate weaknesses. 10. Maintain an inventory of all applications and services using Microsoft JDBC Driver for SQL Server 10.2 to prioritize mitigation efforts.

Description

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.

Impact

The vulnerability poses a significant risk to organizations relying on Microsoft JDBC Driver for SQL Server 10.2 for database connectivity, especially those using version 1.0.0. Successful exploitation can lead to spoofing attacks that compromise the confidentiality and integrity of sensitive data transmitted between applications and SQL Server databases. This can result in unauthorized data access, data tampering, or interception of credentials and queries. The absence of availability impact means systems remain operational but potentially compromised. Given the widespread use of Microsoft SQL Server in enterprise environments and the popularity of Java applications connecting via JDBC, the scope of affected systems is broad. Attackers could exploit this vulnerability to conduct targeted attacks on financial institutions, healthcare providers, government agencies, and large enterprises, leading to data breaches, regulatory penalties, and reputational damage. The requirement for user interaction limits automated exploitation but does not eliminate risk, as many applications initiate database connections automatically or through user actions. The lack of known exploits in the wild suggests a window of opportunity for proactive defense before active exploitation occurs.

Summary

CVE-2025-59250 is a vulnerability identified in Microsoft JDBC Driver for SQL Server version 10.2, specifically in version 1.0.0 of the driver. The root cause is improper input validation (CWE-20), which allows an attacker to perform spoofing attacks over a network. Spoofing in this context means an attacker can impersonate a legitimate entity or manipulate communications between a client application and the SQL Server database, potentially intercepting or altering data. The vulnerability does not require any privileges (PR:N) but does require user interaction (UI:R), such as initiating a connection or executing a query using the vulnerable driver. The attack vector is network-based (AV:N), making it exploitable remotely without physical access. The CVSS v3.1 base score is 8.1, reflecting high severity due to high impact on confidentiality and integrity (C:H/I:H) but no impact on availability (A:N). The scope is unchanged (S:U), meaning the vulnerability affects only the vulnerable component without extending beyond it. The exploitability is considered low complexity (AC:L), and no known exploits have been reported in the wild yet. This vulnerability could be leveraged in man-in-the-middle scenarios or by attackers controlling network infrastructure to impersonate database servers or clients, leading to data leakage or unauthorized data manipulation. The lack of available patches at the time of publication necessitates immediate attention to monitoring and mitigation strategies.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design · Attack Surface Reduction
Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of…
Architecture and Design · Libraries or Frameworks
Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
Architecture and Design · Implementation · Attack Surface Reduction
Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Buffer Overflow via Environment Variables (opens in a new tab)
Server Side Include (SSI) Injection (opens in a new tab)
Cross Zone Scripting (opens in a new tab)
Command Line Execution through SQL Injection (opens in a new tab)
Object Relational Mapping Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250 (opens in a new tab)

Community reviews

Loading reviews…