Microsoft assigns CVE-2026-67373 a CVSS base score of 8.8 and a temporal score of 7.7. The complete CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The weakness is classified as CWE-122.
The practical point for SQL Server operators is that this is a server-side code-execution issue with low attack complexity and no user-interaction requirement. Microsoft’s advisory says authentication is required, but a successful attacker could connect to the server and trigger memory corruption through a crafted query or request, potentially gaining code execution on that server. The required privilege is therefore a meaningful barrier, but it does not make patching optional in environments where SQL Server credentials are shared, delegated, exposed to application tiers, or available to lower-trust users.
Microsoft lists the vulnerability as affecting Microsoft SQL Server 2025 for x64-based Systems in both the CU8 and GDR servicing tracks. Administrators should patch the track they have deployed rather than treating the two packages as interchangeable.
Publicly disclosed: No
Exploited: No
Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should guide prioritization, not replace remediation: the advisory describes a remotely reachable path to code execution after authentication, and the vendor has explicitly marked customer action as required.
The attack path begins with SQL Server authentication
Microsoft describes CVE-2026-67373 as a heap-based buffer overflow in SQL Server. Its advisory states that an authenticated attacker could connect to an affected SQL Server and submit a specially crafted query or request that triggers a memory-corruption condition, allowing the attacker to execute code on the server.
Two details in the CVSS vector reinforce the operational risk. AV:N identifies network attack vector, while AC:L means the vulnerability has low attack complexity. PR:L indicates that the attacker needs low privileges, and UI:N confirms that no separate user action is required after the request is sent.
The result is a patching case that should be evaluated in terms of who can authenticate to the instance, rather than only whether the instance is directly exposed to the public internet. A SQL Server used by applications, reporting systems, automated jobs, or internal users can have a much larger authenticated population than its network perimeter initially suggests. The advisory does not describe a client-side prerequisite or a user-click scenario; the vulnerable processing occurs on the SQL Server after the crafted input reaches it.
The potential impact spans confidentiality, integrity, and availability, reflected in the C:H/I:H/A:H elements of Microsoft’s CVSS vector. For administrators, that makes post-installation verification important: the remediation objective is not merely to record that an update was approved, but to confirm that each SQL Server instance is running its designated fixed build.
CU8 deployments need KB5122769 and build 17.0.4085.5
For Microsoft SQL Server 2025 for x64-based Systems (CU8), Microsoft’s remediation is explicit: For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
That KB-to-build pairing matters in mixed estates. “SQL Server 2025” alone is not enough to determine remediation status when systems follow different servicing tracks. An administrator who manages CU8 deployments should use KB5122769 and verify the resulting server build is 17.0.4085.5.
This is also the track where change-management records should preserve both identifiers. KB5122769 tells teams which Microsoft update was deployed; build 17.0.4085.5 is the concrete fixed version to validate on the SQL Server installation. Recording only one of them leaves ambiguity when incident-response, audit, or operations teams later need to establish whether CVE-2026-67373 was remediated.
GDR deployments need KB5122770 and build 17.0.1135.8
For Microsoft SQL Server 2025 for x64-based Systems (GDR), Microsoft provides a separate update path: For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
The GDR package is therefore not a substitute for the CU8 package, and KB5122769 is not the stated remediation for a server on the GDR servicing track. Organizations should identify the track installed on each SQL Server 2025 instance before scheduling deployment, then match that instance to the corresponding KB and fixed build.
A concise remediation record for this vulnerability should distinguish the two supported outcomes:
- Microsoft SQL Server 2025 for x64-based Systems (CU8) is remediated by installing KB5122769 and reaching fixed build 17.0.4085.5.
- Microsoft SQL Server 2025 for x64-based Systems (GDR) is remediated by installing KB5122770 and reaching fixed build 17.0.1135.8.
Patch verification should focus on the running build
The immediate work is to locate SQL Server 2025 installations, determine whether each system uses the CU8 or GDR track, deploy the matching Microsoft update, and verify the resulting build number. CVE-2026-67373 is resolved for the listed CU8 product at 17.0.4085.5 and for the listed GDR product at 17.0.1135.8.
Microsoft’s advisory does not frame this as a mitigation-only issue. It supplies package-based remediations for both affected products, while its customer-action status is affirmative. The operational priority should therefore be deployment and verification of the appropriate fixed build, with particular attention to servers reachable by authenticated application accounts or users.
For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.