CVE-2026-67626: Microsoft SQL Server Denial of Service Vulnerability
Microsoft SQL Server Denial of Service Vulnerability
Other sources
Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authorized and able to reach the affected SQL Server instance over the network. The available information does not identify any required privilege level beyond authorized access.
What is the likely impact of successful exploitation?
Successful exploitation can consume uncontrolled resources and deny service on the affected SQL Server. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
Which SQL Server releases are listed as affected?
The affected software list includes Microsoft SQL Server 2025, SQL Server 2025 CU9, Microsoft SQL Server 2022, and SQL Server 2022 CU27.