CVE-2026-67370: Microsoft SQL Server Elevation of Privilege Vulnerability

The issue is documented in Microsoft’s Security Response Center advisory as improper neutralization of special elements used in an sql command ('sql injection') in SQL Server. In practical terms, the security boundary at risk is inside the database service: Microsoft says an authenticated attacker with explicit permissions can log in to the SQL server and elevate those permissions to sysadmin.

A successful exploit can therefore turn a limited SQL Server login into the highest SQL Server administrative role. For database administrators, the immediate priority is to identify every affected server by its servicing track—Cumulative Update or GDR—and deploy the corresponding package rather than treating this as a single, version-agnostic SQL Server update.

CVE-2026-67370 severity and attack conditions​

CVE-2026-67370 is categorized as Important and maps to CWE-89, the weakness class for SQL injection. Microsoft’s full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, with a CVSS base score of 8.8 and a temporal score of 7.7.

The vector describes a network-reachable issue with low attack complexity, low privileges required, and no user interaction required. It also scores confidentiality, integrity, and availability impact as High. Those characteristics explain why a vulnerability requiring authentication still merits prompt remediation: the advisory’s stated outcome is SQL sysadmin access, which can give the attacker administrative control within the SQL Server instance.

Microsoft’s advisory is explicit about the required starting point. The attacker must be authenticated and have explicit permissions, then log in to the SQL server to exploit the flaw. This is not described as an unauthenticated, internet-wide compromise path; it is an elevation-of-privilege problem after an attacker has gained or misused an authorized database identity.

Microsoft’s published status fields are:

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should inform patch prioritization, but it does not reduce the importance of checking privileged applications, integration accounts, contractor access, and other SQL logins with explicit permissions. The flaw’s value to an attacker comes from converting access that already exists into SQL sysadmin privileges.

The affected SQL Server servicing branches​

The remediation set spans both Cumulative Update and GDR branches. Administrators need to match each server to its installed servicing line, because the KB number and fixed build differ even for the same major SQL Server release.

For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.

For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.

For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.

For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.

For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.

For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.

For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.

For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.

The practical risk in this release is an inventory mistake: SQL Server 2017 through SQL Server 2025 each have two listed update paths, and the fixed build is tied to the selected path. A deployment process that tracks only the SQL Server major version can select the wrong package or fail to verify the post-install version accurately.

Why SQL sysadmin is the material consequence​

Microsoft’s advisory answers the core impact question directly: an attacker who successfully exploits CVE-2026-67370 could gain SQL sysadmin privileges. The relevant security decision is therefore not whether an account already has broad database permissions, but whether it has enough explicit permission to reach the vulnerable behavior and then cross into the SQL sysadmin role.

SQL sysadmin is a materially different privilege level from an ordinary application or database login. Microsoft’s advisory does not describe a data-only exposure; its CVSS scoring assigns High impact to confidentiality, integrity, and availability, and the stated privilege outcome is administrative control in SQL Server.

For organizations that separate database administration from application ownership, that distinction should shape the response. Review SQL-authenticated and integrated identities that can connect to affected instances, especially identities shared by services or deployment processes. The update removes the vulnerability; access review can reduce exposure during the window before all instances reach their fixed builds.

Deployment verification needs to use the fixed build​

The remediation target is more specific than a generic instruction to “apply September updates.” Each supported product entry has a KB and a destination build. Administrators should record the server’s product servicing branch before scheduling the update, apply the matching KB, and verify the stated fixed build after deployment.

The required target builds are:

Microsoft’s own advisory establishes both the exploit path and the remediation outcome: an authenticated attacker with explicit permissions could elevate to sysadmin, and affected installations must move to their branch-specific KB and fixed build. The operational endpoint is clear—every listed SQL Server instance should be brought to its corresponding fixed build, with deployment records retaining the KB, servicing branch, and verified version.