CVE-2026-68784: Microsoft SQL Server Information Disclosure Vulnerability

Microsoft’s Security Response Center advisory describes CVE-2026-68784 as an out-of-bounds read in SQL Server. The practical consequence stated by Microsoft is significant for database administrators: an attacker who successfully exploits it could potentially read portions of SQL Server process memory. This is an information-disclosure issue, rather than a vulnerability that Microsoft says enables code execution, integrity modification, or service disruption.

The advisory was published on September 8, 2026. Microsoft assigns the issue a CVSS base score of 6.5 and a temporal score of 5.7, classifying it as Important. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C.

An authorized network attacker is the threat model​

CVE-2026-68784 is categorized as CWE-125, an out-of-bounds read. Microsoft’s description says the attack can occur over a network, has low attack complexity, requires low privileges, and requires no user interaction. The vulnerability’s CVSS vector also assigns a high confidentiality impact, while assigning no integrity or availability impact.

The authorization prerequisite changes patch prioritization but does not remove the operational concern. SQL Server instances commonly have application identities, service accounts, database users, administrators, and delegated support personnel with authenticated access. An organization should treat any account capable of reaching an exposed affected SQL Server service as part of the relevant attack surface until its database team establishes otherwise.

Microsoft’s advisory is explicit about the type of data potentially exposed: successful exploitation could allow the attacker to read portions of process memory. The advisory does not specify what particular values or records might be resident in memory under a given workload. Administrators should therefore avoid assuming that normal database permission boundaries fully constrain the possible disclosure described by the vulnerability.

Microsoft’s published status fields are:

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment is useful for triage, but it is not a substitute for deployment: the vendor has issued updates across eight SQL Server servicing targets and explicitly requires customer action.

CU and GDR estates need different KB packages​

The remediation path depends on both the SQL Server generation and the servicing branch installed. This is the point most likely to produce an incomplete deployment: a CU package is not interchangeable with the corresponding GDR package simply because both address the same CVE.

For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4. For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.

For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9. For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.

For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2. For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.

For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5. For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.

The build number is the useful post-deployment control here. A change record showing that a KB was approved or downloaded does not prove that every SQL Server instance has reached its fixed version. Inventory processes should identify the installed SQL Server release and servicing track, deploy the matching KB, then verify the resulting instance build against Microsoft’s fixed-build value.

What to prioritize in SQL Server patching​

The CVSS data presents a focused risk profile. The vulnerability is remotely reachable and needs neither a local interactive session nor user action, but it requires an authorized attacker. For organizations with SQL Server instances broadly reachable by applications, shared administrative tooling, or multiple teams, the exposure may be more relevant than the “authorized” qualifier initially suggests.

Priority should go first to affected SQL Server instances where authenticated access is available to many application identities or operational users, followed by systems that process sensitive information and systems where patch validation has been deferred. The appropriate update is determined by the specific installed CU or GDR branch, not by the SQL Server major version alone.

Administrators should also make the distinction between the vulnerability’s stated effect and broader assumptions about compromise. Microsoft has identified a confidentiality impact: process-memory disclosure. The supplied CVSS scoring assigns no integrity impact and no availability impact. Teams should keep the remediation objective precise—remove the out-of-bounds read condition through the listed SQL Server update—while handling any incident investigation according to their own access and telemetry records.

A deployment record should capture the fixed build​

For each affected SQL Server instance, the deployment record should include the product string, installed servicing branch, KB selected, and final build number. This prevents a common fleet-management failure in which a dashboard records a generic “SQL Server patched” state despite different CU and GDR populations requiring distinct packages.

The complete Microsoft remediation set for CVE-2026-68784 is:

Microsoft’s advisory identifies the vulnerability as “SQL Server Information Disclosure Vulnerability: Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.” The update action is correspondingly straightforward, but the branch-specific KB mapping requires care. SQL Server teams should verify that every applicable 2017, 2019, 2022, and 2025 CU or GDR installation reaches its listed fixed build.