CVE-2026-67379: Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
Other sources
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2190.7Patch KB5122773 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4275.2Patch KB5122768 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1135.8Patch KB5122770 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4490.9Patch KB5122772 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1200.5Patch KB5122771 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.4085.5Patch KB5122769
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized to access the affected SQL Server instance and able to reach it over the network. The issue does not require user interaction, but exploitation has high attack complexity.
What is the potential impact if exploitation succeeds?
A successful attacker can execute code on the affected SQL Server. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the vulnerable security authority.
Which SQL Server releases are identified as affected?
The affected software list includes Microsoft SQL Server 2019, SQL Server 2019 CU 32, SQL Server 2022, SQL Server 2022 CU 26, SQL Server 2025, and SQL Server 2025 CU8.
How can I determine whether my environment is exposed?
Identify SQL Server instances running one of the listed SQL Server 2019, 2022, or 2025 releases, and determine whether authorized users can connect to those instances over the network. The provided data does not include a detection method, affected build range, or workaround.