Microsoft’s advisory assigns CVE-2026-68785 a CVSS base score of 4.9 and a temporal score of 4.3. Its full vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C.
The score reflects an attack that is network-reachable, requires low attack complexity, and does not require user interaction. However, the attacker must already hold high privileges. Microsoft’s impact assessment is availability-only: confidentiality and integrity are rated as unaffected, while availability is rated High. The underlying weakness is CWE-122, heap-based buffer overflow.
Microsoft’s official advisory describes the issue as follows: “SQL Server Remote Code Execution Vulnerability: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.”
Publicly disclosed: No
Exploited: No
Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should inform prioritization, but it does not remove the patching requirement: the vulnerability is remotely reachable after an attacker has the necessary privileges, and a successful exploit can execute code.
The affected SQL Server servicing branches
The advisory covers eight distinct SQL Server package paths. The practical detail for administrators is that the correct fix depends on whether the server is maintained on a cumulative-update branch or a GDR branch. Those are separate update tracks, with separate KB packages and fixed build numbers.
Microsoft lists the following affected products:
- Microsoft SQL Server 2017 for x64-based Systems (CU 31).
- Microsoft SQL Server 2017 for x64-based Systems (GDR).
- Microsoft SQL Server 2019 for x64-based Systems (CU 32).
- Microsoft SQL Server 2019 for x64-based Systems (GDR).
- Microsoft SQL Server 2022 for x64-based Systems (CU 26).
- Microsoft SQL Server 2022 for x64-based Systems (GDR).
- Microsoft SQL Server 2025 for x64-based Systems (CU8).
- Microsoft SQL Server 2025 for x64-based Systems (GDR).
The distinction is important during maintenance planning. An administrator should identify the servicing baseline already deployed rather than treating the CU and GDR packages as interchangeable fixes. Microsoft has provided one fixed build for each affected product path.
KB packages and fixed builds for CVE-2026-68785
For Microsoft SQL Server 2017 for x64-based Systems (CU 31), install KB5122774 to reach fixed build 14.0.3550.4.
For Microsoft SQL Server 2017 for x64-based Systems (GDR), install KB5122775 to reach fixed build 14.0.2130.4.
For Microsoft SQL Server 2019 for x64-based Systems (CU 32), install KB5122772 to reach fixed build 15.0.4490.9.
For Microsoft SQL Server 2019 for x64-based Systems (GDR), install KB5122773 to reach fixed build 15.0.2190.7.
For Microsoft SQL Server 2022 for x64-based Systems (CU 26), install KB5122768 to reach fixed build 16.0.4275.2.
For Microsoft SQL Server 2022 for x64-based Systems (GDR), install KB5122771 to reach fixed build 16.0.1200.5.
For Microsoft SQL Server 2025 for x64-based Systems (CU8), install KB5122769 to reach fixed build 17.0.4085.5.
For Microsoft SQL Server 2025 for x64-based Systems (GDR), install KB5122770 to reach fixed build 17.0.1135.8.
The fixed-build mapping gives administrators a verification target after deployment. A completed maintenance change should be checked against the build appropriate to the server’s listed product branch, rather than recorded only as a successful KB installation.
What the advisory establishes about risk
CVE-2026-68785 is categorized as an Important remote code execution issue, yet its CVSS vector describes a more constrained exposure than unauthenticated SQL Server attacks. The required privileges are High, represented by PR:H, and Microsoft rates the exploit code maturity component as E:U. The advisory also records AC:L, meaning Microsoft does not characterize the attack itself as technically complex once the attacker meets the privilege prerequisite.
The availability impact is the central risk described by the CVSS vector: C:N/I:N/A:H. Microsoft does not assign confidentiality or integrity impact in that rating, while a successful attack has a High availability consequence. For SQL Server operators, that makes the advisory particularly relevant to systems where service interruption would affect applications, reporting, transaction processing, or other workloads dependent on the database instance.
Microsoft’s remediation is specific: install the matching update for the CU or GDR servicing path and confirm the corresponding fixed build. The affected versions span four SQL Server generations, so inventory work should include older SQL Server 2017 and SQL Server 2019 deployments alongside SQL Server 2022 and SQL Server 2025 systems.