Microsoft’s Security Response Center describes the flaw as improper link resolution before file access, also called link following, in SQL Server. The vulnerability has a CVSS base score of 8.8 and a CVSS temporal score of 7.7, making this a patching priority for administrators of affected database instances even though exploitation begins with authenticated access rather than unauthenticated network access.
Microsoft’s advisory assigns CVE-2026-67368 the following status:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should inform prioritization, but it does not remove the operational consequence Microsoft describes: a successful attacker can gain SQL sysadmin privileges.
The flaw can turn authenticated SQL access into sysadmin control
CVE-2026-67368 is classified as CWE-59, the weakness category for improper link resolution before file access. Microsoft states: “SQL Server Elevation of Privilege Vulnerability: Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.”
The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. In practical terms, the vector records network reachability, low attack complexity, required low privileges, and no user interaction. The high confidentiality, integrity, and availability impacts are consistent with the stated destination of the attack: SQL sysadmin authority.
Microsoft’s advisory is unusually direct about the prerequisite. “An authenticated attacker with explicit permissions could exploit the vulnerability by logging in to the SQL server and could then elevate their privileges to sysadmin,” it says. The attack therefore is not described as an Internet-wide pre-authentication compromise; the relevant exposure is an SQL Server instance where a user or account can authenticate and holds the explicit permissions required to trigger the flaw.
The distinction is important for database administrators reviewing service accounts, application logins, vendor integrations, and delegated operational accounts. A compromised account with ordinary application duties may be constrained at the SQL permission level; SQL sysadmin is the level from which those constraints can be removed. Microsoft explicitly says, “An attacker who successfully exploited this vulnerability could gain SQL sysadmin privileges.”
CU and GDR deployments require different updates
The advisory’s affected-product list includes both Cumulative Update and GDR branches. Administrators cannot select an update solely from the SQL Server major version: the correct KB depends on the installed servicing track. The fixed build numbers provide the practical inventory target after deployment.
For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4. For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9. For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2. For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
Inventory must identify the servicing branch, not only the major release
The eight-package structure is the operational detail that can cause remediation mistakes. SQL Server 2019 alone has separate fixes for Microsoft SQL Server 2019 for x64-based Systems (CU 32) and Microsoft SQL Server 2019 for x64-based Systems (GDR); the same split applies to the 2017, 2022, and 2025 products named in the advisory.
Patch teams should therefore match installed instances to the full product designation in Microsoft’s affected-product record before approving the corresponding KB. A report that records only “SQL Server 2022,” for example, does not establish whether KB5122768 or KB5122771 is the relevant package, nor whether the fixed target is 16.0.4275.2 or 16.0.1200.5.
The required remediation, in Microsoft’s wording, is to install the appropriate package and reach the associated fixed build:
- For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.
- For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
- For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.
- For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
- For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.
- For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
- For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
- For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
Prioritize accounts that can log in with explicit permissions
Microsoft has not described a user-interaction step in the CVSS vector, and its advisory places the attack path at an authenticated login with explicit permissions. For defenders, the immediate work is patch deployment; the parallel review is identifying which users, applications, jobs, and integrations can log into the affected SQL Server instances and what explicit permissions they possess.
This is particularly relevant where SQL authentication, application connection strings, automated maintenance jobs, or shared operational accounts create a broad set of valid logins. The advisory does not say that every authenticated SQL user is exploitable. It says an authenticated attacker with explicit permissions could exploit the vulnerability. Administrators should preserve that distinction rather than treating account presence alone as proof of exposure.
CVE-2026-67368 does, however, establish a clear privilege boundary at risk: SQL sysadmin. Because Microsoft says successful exploitation can yield SQL sysadmin privileges, remediation should be verified by the build number rather than by assuming that a completed maintenance window installed the package intended for that server’s servicing track.
The concrete completion criteria are the eight fixed builds listed by Microsoft. Systems on Microsoft SQL Server 2017 for x64-based Systems (CU 31) should reach 14.0.3550.4; SQL Server 2017 GDR systems should reach 14.0.2130.4. The corresponding targets are 15.0.4490.9 and 15.0.2190.7 for SQL Server 2019, 16.0.4275.2 and 16.0.1200.5 for SQL Server 2022, and 17.0.4085.5 and 17.0.1135.8 for SQL Server 2025.