CVE-2025-59250 JDBC Driver for SQL Server Spoofing Vulnerability
An unauthorized attacker can perform spoofing over the network due to improper input validation in the Microsoft JDBC Driver for SQL Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59250?
CVE-2025-59250 is a high-severity vulnerability in Microsoft JDBC Driver for SQL Server 10.2, published on 14 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
Weakness: CWE-20
Which versions are affected by CVE-2025-59250?
14 open source packages ship an affected version, including com.microsoft.sqlserver:mssql-jdbc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.microsoft.sqlserver:mssql-jdbc Maven | From 11.2.0.jre11 | 11.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 11.2.0.jre11 | 11.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.10.0.jre11 | 12.10.2.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.10.0.jre11 | 12.10.2.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.2.0.jre11 | 12.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.2.0.jre11 | 12.2.1.jre11 |
8 more packages
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.6.0.jre11 | 12.6.5.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.6.0.jre11 | 12.6.5.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.8.0.jre11 | 12.8.2.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 12.8.0.jre11 | 12.8.2.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 13.2.0.jre11 | 13.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 13.2.0.jre11 | 13.2.1.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 8.3.0.jre11-preview | 10.2.4.jre11 |
com.microsoft.sqlserver:mssql-jdbc Maven | From 8.3.0.jre11-preview | 10.2.4.jre11 |
Products include Microsoft Jdbc Driver for Sql Server.
How do I fix CVE-2025-59250?
Upgrade com.microsoft.sqlserver:mssql-jdbc to a fixed version for your release line: 11.2.4.jre11, 12.10.2.jre11, 12.2.1.jre11 or 12.6.5.jre11.
Is CVE-2025-59250 being exploited?
There is no known exploitation of CVE-2025-59250 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-IW64102, CLEANSTART-2026-MW74031, CLEANSTART-2026-ZC26569, ECHO-d399-babc-bf30, GHSA-m494-w24q-6f7w, MINI-c8qq-8q7w-xpg9 and 3 more.