CVE-2026-67636

Microsoft SQL Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 51st percentile. A vendor fix is available.

CVSS 3.19.0Critical EPSS percentile51st0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft SQL Server edition and build you run (for example, whether it’s 2019 CU 32 / 2019 GDR / 2022 CU 26 / 2022 GDR / 2025 CU8 / 2025 x64 GDR).
If your build matches any affected level, plan an update to the fixed build for your exact branch: 15.0.4490.9 (2019 CU 32), 15.0.2190.7 (2019 GDR), 16.0.4275.2 (2022 CU 26), 16.0.1200.5 (2022 GDR), 17.0.4085.5 (2025 CU8), or 17.0.1135.8 (2025 x64 GDR).
Test the update in a staging environment (if you have one), then roll it out to production during your next maintenance window.
After updating, verify the server reports the expected fixed build number and review authentication and SQL server access logs for unusual activity around the time of any suspected probing.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a Microsoft SQL Server bug that can allow someone on the network to run malicious code, but it’s mainly a risk for businesses that are reachable and have a realistic path for an attacker to get authorized access; apply the specific SQL Server updates listed in this advisory.

Microsoft SQL Server has a remote code execution weakness (CWE-125) triggered through an out-of-bounds read in the SQL Server network-accessible functionality; affected SQL Server versions should be updated to the fixed cumulative update/GDR build numbers provided.

If you're affected

Full server compromise
Malware/ransomware risk
Data theft or modification
Service disruption

What is it

SQL Server is the database engine many businesses use to store customer and business data. This vulnerability is a flaw that can let an attacker run code on the SQL Server machine from across the network. Think of it like a mistake in how SQL Server reads memory: with the right conditions, it could be turned into a way to take over the server and then access or destroy data.

Who is affected

This matters if your organization runs Microsoft SQL Server at one of the affected build levels listed (2019 CU 32/GDR, 2022 CU 26/GDR, 2025 CU8, or 2025 x64 GDR). Because the weakness is described as requiring an authorized attacker, it’s most likely to be a concern when an attacker can reach SQL Server and has a credible way to obtain or already has authorization (for example, stolen credentials or an overly permissive internal access path). Only treat it as a practical risk when the attacker can reach your SQL Server over the network and the “authorized attacker” condition can be met.

How urgent is it

This is RED because it’s a remote code execution issue in Microsoft SQL Server, which means attackers may be able to move from network access to full server compromise. There is no public exploit code on record, and it is not listed in CISA KEV, but the impact is high enough that you should prioritize patching to the fixed builds immediately.

What to do — in detail

Confirm exposure

Identify every SQL Server instance and determine its exact version/build. Focus on whether it matches any of these tracks: Microsoft SQL Server 2019 (CU 32), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2022 (CU 26), Microsoft SQL Server 2022 (GDR), Microsoft SQL Server 2025 (CU8), or Microsoft SQL Server 2025 for x64-based Systems (GDR).
For each instance, confirm it is on the affected build level (if you don’t know the build, capture the server’s current update/build information from your standard SQL Server inventory process).

Apply the correct fixed update

Update each affected instance to the fixed build number for its exact branch:

Microsoft SQL Server 2019 (CU 32) → fixed in 15.0.4490.9
Microsoft SQL Server 2019 (GDR) → fixed in 15.0.2190.7
Microsoft SQL Server 2022 (CU 26) → fixed in 16.0.4275.2
Microsoft SQL Server 2022 (GDR) → fixed in 16.0.1200.5
Microsoft SQL Server 2025 (CU8) → fixed in 17.0.4085.5
Microsoft SQL Server 2025 for x64-based Systems (GDR) → fixed in 17.0.1135.8

Upgrade notes

Patch during a maintenance window when possible; SQL Server updates can involve service restarts.
Test in staging first if your setup is complex (linked databases, replication, jobs, or application connections).
After upgrading, re-check the build number to ensure the instance is actually on the fixed version.

If you can’t patch right away (temporary risk reduction)

Reduce network exposure to SQL Server (allow only the application servers/admin IPs that truly need access).
Review who can authenticate to SQL Server and tighten permissions so there are no unnecessary accounts or overly broad access paths.
Monitor for unusual SQL Server access patterns (especially from unexpected hosts) in the period before the patch.

What to monitor after patching

Successful and failed authentication events related to SQL Server.
Any unexpected SQL activity from accounts that normally shouldn’t be used.
Connection attempts from new or unusual client sources.

KEV and timelines

This CVE is not listed in CISA KEV, and no specific due date is provided in the findings.

Technical context

Summary

CVE-2026-67636 is a Microsoft SQL Server remote code execution vulnerability (CWE-125). The mechanism described indicates an out-of-bounds read that can be leveraged to execute code over the network when an attacker meets the authorization condition.

Exploitation status

No public exploit code is on record. The vulnerability is not listed in CISA KEV. The system-level verdict for urgency is RED.

Likelihood signals

A predicted likelihood value was provided (EPSS-style prediction), but because KEV/news does not confirm exploitation in the findings, exploitation likelihood is not presented publicly.

Attack surface and prerequisites

The attack vector is network-based (remote). The described requirement that the attacker be “authorized” suggests that compromise scenarios involving credential access, overly permissive SQL permissions, or internal network reachability are the most relevant.

Fixed versions

Fixed builds are provided per SQL Server branch/build track, and should be applied exactly as listed in the PATCH findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS51st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 51st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 9 days, from the signal feeds we watch.

2026-09-17Patch availablerecord updated
2026-09-15Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft SQL Server 2019 (CU 32)DatabaseOn-premDatabases / relational
- Microsoft SQL Server 2019 (GDR)DatabaseOn-premDatabases / relational
- Microsoft SQL Server 2022 (CU 26)On-premOperating Systems / windows
- Microsoft SQL Server 2022 (GDR)DatabaseOn-premDatabases / relational
- Microsoft SQL Server 2025 (CU8)On-premOperating Systems / windows
- Microsoft SQL Server 2025 for x64-based Systems (GDR)DatabaseOn-premDatabases / relational
- sql server 2019DatabaseOn-premDatabases / relational
- sql server 2022DatabaseOn-premDatabases / relational

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 9.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable