CVE-2016-7270

7.5 highEPSS 20%

The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET Information Disclosure Vulnerability."

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-310
Published: 2016-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

microsoft:.net_framework

References

http://www.securityfocus.com/bid/94741
http://www.securitytracker.com/id/1037455
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-155
http://www.securityfocus.com/bid/94741
http://www.securitytracker.com/id/1037455

Check your stack JSON