CVE-2026-67631: Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft assigns the flaw a CVSS base score of 8.8 and a temporal score of 7.7. Its published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C, which describes a network-reachable issue with low attack complexity, required privileges, and no user interaction. A successful attack can affect confidentiality, integrity, and availability at high impact.

Microsoft’s advisory describes CVE-2026-67631 as a heap-based buffer overflow in SQL Server that allows an authorized attacker to execute code over a network. The weakness is classified as CWE-122.

The attack requires SQL Server authentication​

Microsoft says an authenticated attacker could connect to an affected SQL Server and submit a specially crafted query or request that triggers a memory-corruption condition, allowing code execution on the server. Authentication is required; user interaction is not required.

That prerequisite should shape, rather than delay, patch prioritization. This is not described as an unauthenticated exposure to every reachable SQL Server listener. It is a risk associated with accounts able to authenticate to the database service, including legitimate application identities, service accounts, administrative users, and potentially compromised low-privilege credentials where the connection path permits the crafted request.

For operations teams, the relevant exposure inventory is therefore broader than a list of internet-facing SQL hosts. It includes internally reachable production instances, application tiers with persistent SQL credentials, shared environments, reporting servers, and development or test deployments that use the same servicing branch as production. The advisory’s no-user-interaction condition also means normal user caution cannot interrupt the described attack sequence once an attacker has valid access and can submit the required request.

Microsoft’s assessment is Exploitation Less Likely. This is a risk assessment, not a substitute for remediation: Microsoft has issued fixes across both cumulative update and GDR servicing paths for the affected products.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

CVSS details point to server-side impact​

The CVSS vector is particularly useful for separating the vulnerability’s access requirement from its potential result. AV:N identifies a network attack vector, while AC:L indicates low attack complexity. PR:L means the attacker needs low privileges, and UI:N means a user does not need to perform an action for exploitation to proceed.

The S:U portion keeps the assessed impact within SQL Server’s security authority, but the three H values for confidentiality, integrity, and availability explain the Critical severity. Microsoft’s advisory says the memory corruption can enable code execution on the server. For a database platform, that makes patching a service-owner responsibility rather than an application-only change: the remedial target is the SQL Server installation build.

The temporal score of 7.7 incorporates the vector’s E:U, RL:O, and RC:C values. Administrators should retain both the base score and the temporal score in vulnerability-management records, since Microsoft published both values for this CVE and the former captures the technical severity while the latter is the advisory’s time-sensitive scoring assessment.

CU and GDR deployments have different KB targets​

Microsoft has supplied distinct remediation packages for cumulative-update and GDR installations. Teams should not select a package merely by SQL Server major version; the correct target also depends on whether the instance is maintained on the named CU or GDR branch.

Microsoft’s remediation is explicit for each branch:

• For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.
• For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
• For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.
• For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
• For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.
• For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
• For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
• For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.

Verify the installed build after deployment​

The KB number is a deployment record; the fixed build is the operational verification point. Administrators should record the installed SQL Server version before maintenance, deploy the update matching the actual CU or GDR servicing branch, then verify that the instance has reached Microsoft’s stated fixed build before closing CVE-2026-67631 in the vulnerability-management system.

This distinction is consequential in estates that contain several major SQL Server releases or use both servicing models. A successful update on a SQL Server 2022 CU installation does not remediate a SQL Server 2022 GDR installation, because Microsoft has assigned KB5122768 and build 16.0.4275.2 to the former, and KB5122771 and build 16.0.1200.5 to the latter. The same branch-specific separation applies to SQL Server 2017, SQL Server 2019, and SQL Server 2025.

Microsoft has marked customer action as required. The concrete completion criteria are the eight KB-to-build mappings in the advisory: every affected SQL Server instance must be updated to its corresponding fixed build, with CVE-2026-67631 tracked as a Critical authenticated remote code execution issue until that verification is complete.