Microsoft’s MSRC advisory describes CVE-2026-68781 as an out-of-bounds read in SQL Server that “allows an authorized attacker to disclose information over a network.” The vulnerability is classified as CWE-125, Out-of-bounds Read. Microsoft says an attacker who successfully exploits it could potentially read portions of process memory.
The practical exposure is therefore tied to an attacker who already has authorization to interact with the SQL Server instance; the advisory does not describe remote code execution, modification of database data, or a denial-of-service outcome. But disclosure of process memory can be consequential in database environments because the contents and sensitivity of memory vary with the server’s workload and active processes.
Microsoft assigns CVE-2026-68781 a CVSS base score of 6.5 and a temporal score of 5.7. The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.
Publicly disclosed: No
Exploited: No
Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should inform prioritization, but it does not remove the need to patch: Microsoft explicitly marks customer action as required.
The flaw can expose SQL Server process memory
MSRC’s advisory calls the issue a “SQL Server Information Disclosure Vulnerability” and identifies the underlying condition as an out-of-bounds read in SQL Server. An out-of-bounds read occurs when software reads data beyond the intended boundaries of a memory region.
For CVE-2026-68781, Microsoft’s stated consequence is information disclosure over a network by an authorized attacker. The advisory’s additional clarification is important for incident-response and risk-review teams: successful exploitation could allow the attacker to read portions of SQL Server process memory.
The CVSS vector records network attack vector, low attack complexity, low privileges required, and no user interaction. Its impact components specify high confidentiality impact, with no integrity or availability impact. In operational terms, this is a patching matter for SQL Server estate owners rather than a reason to expect the update to address data modification or service availability risks described by this CVE.
SQL Server 2017 and 2019 fixes
Microsoft has published distinct KB packages and fixed build targets for SQL Server 2017 and SQL Server 2019. Administrators should verify whether each instance follows the CU or GDR servicing path before selecting a package; the KB numbers and target builds differ by path.
For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.
For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.
For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
The separate 2017 and 2019 mappings are material for asset inventories that record only a major SQL Server version. “SQL Server 2019” alone is not enough to select the remediation package; the deployed CU or GDR track determines the applicable KB and the build number that demonstrates the fix is installed.
SQL Server 2022 and 2025 fixes
The same split servicing model applies to SQL Server 2022 and SQL Server 2025. Microsoft has assigned different updates and fixed builds to their CU and GDR offerings.
For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.
For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
The build targets provide a more reliable post-deployment check than a change ticket stating that a KB was approved or scheduled. Teams responsible for production databases should confirm that each patched instance has reached the fixed build applicable to its listed product and servicing branch.
Patch selection needs to match the installed servicing branch
CVE-2026-68781 covers eight specifically listed SQL Server product-and-update combinations. Microsoft’s remediation is a versioned deployment instruction for each one, rather than a single generic SQL Server package:
- For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.
- For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
- For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.
- For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
- For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.
- For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
- For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
- For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
The immediate administrative task is to inventory SQL Server 2017 through SQL Server 2025 instances against these exact CU and GDR entries, deploy the corresponding KB, and validate the resulting build. For CVE-2026-68781, that verification is the concrete point at which an instance reaches Microsoft’s stated fixed version for the information-disclosure flaw.