Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-67388: Microsoft SQL Server may let attacker run code remotely

CVE-2026-67388 · published 1 month ago

Summary

Versions of Microsoft SQL Server 2017, 2019 and 2022 that have certain cumulative or general distribution updates contain an error that can be triggered over the network. An attacker who already has access could cause the server to execute their own commands, potentially exposing data or disrupting operations. Apply the latest security updates from Microsoft and limit network access to the database server.

What to do

Update microsoft microsoft sql server 2017 (cu 31) to version 14.0.3550.4 or later.
Update microsoft microsoft sql server 2017 (gdr) to version 14.0.2130.4 or later.
Update microsoft microsoft sql server 2019 (cu 32) to version 15.0.4490.9 or later.
Update microsoft microsoft sql server 2019 (gdr) to version 15.0.2190.7 or later.
Update microsoft microsoft sql server 2022 (cu 26) to version 16.0.4275.2 or later.
Update microsoft microsoft sql server 2022 (gdr) to version 16.0.1200.5 or later.
Update microsoft microsoft sql server 2025 (cu8) to version 17.0.4085.5 or later.
Update microsoft microsoft sql server 2025 for x64-based systems (gdr) to version 17.0.1135.8 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft sql server 2017 (cu 31)	< 14.0.3550.4
microsoft	microsoft sql server 2017 (gdr)	< 14.0.2130.4
microsoft	microsoft sql server 2019 (cu 32)	< 15.0.4490.9
microsoft	microsoft sql server 2019 (gdr)	< 15.0.2190.7
microsoft	microsoft sql server 2022 (cu 26)	< 16.0.4275.2
microsoft	microsoft sql server 2022 (gdr)	< 16.0.1200.5
microsoft	microsoft sql server 2025 (cu8)	< 17.0.4085.5
microsoft	microsoft sql server 2025 for x64-based systems (gdr)	< 17.0.1135.8
microsoft	sql_server_2017	< 14.0.2130.4 >= 14.0.3006.16, < 14.0.3550.4 `cpe:2.3:a:microsoft:sql_server_2017:::::::x64:*`
microsoft	sql_server_2019	< 15.0.2190.7 >= 15.0.4003.23, < 15.0.4490.9 `cpe:2.3:a:microsoft:sql_server_2019:::::::x64:*`
microsoft	sql_server_2022	< 16.0.1200.5 >= 16.0.4003.1, < 16.0.4275.2 `cpe:2.3:a:microsoft:sql_server_2022:::::::x64:*`
microsoft	sql_server_2025	< 17.0.1135.8 >= 17.0.4006.2, < 17.0.4085.5 `cpe:2.3:a:microsoft:sql_server_2025:::::::x64:*`

Original advisory text

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67388 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published8 Sep 2026

Updated3 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-67388 · NVD

CVE-2026-67388 · MITRE

Track software like this

Free during beta