CVE-2026-67628: Microsoft SQL Server Information Disclosure Vulnerability
Microsoft SQL Server Information Disclosure Vulnerability
Other sources
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.4305.5Patch KB5126934 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.4500.2Patch KB5128494 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.5015.4Patch KB5126967 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.1210.3Patch KB5128493 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.0.2200.2Patch KB5128495 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.1145.4Patch KB5128492 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.2140.2Patch KB5128497 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.0.3560.2Patch KB5128496
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authorized to access the affected SQL Server instance. Exploitation can be performed over the network and does not require user interaction.
What is the impact if exploitation succeeds?
The vulnerability is an out-of-bounds read that can disclose information from SQL Server. The provided assessment indicates confidentiality impact only, with no stated integrity or availability impact.
Are default deployments affected?
The available data does not identify a configuration prerequisite beyond running an affected Microsoft SQL Server version. Because exploitation requires high privileges, exposure depends on which authorized users have elevated permissions.
What should teams do if they cannot patch immediately?
Restrict elevated SQL Server permissions to only trusted administrators and limit network access to SQL Server instances. Since exploitation requires an authorized attacker with high privileges, reducing and monitoring privileged access is the relevant temporary mitigation.
Which SQL Server releases are listed as affected?
The affected software list includes Microsoft SQL Server 2017, 2019, 2022, and 2025, including SQL Server 2017 CU31, SQL Server 2019 CU32, SQL Server 2022 CU27, and SQL Server 2025 CU9.