cve-2026-67370

This tag covers CVE-2026-67370, a Microsoft SQL Server elevation of privilege vulnerability disclosed in Microsoft's September 8 security release. The flaw is an Important SQL injection issue that could allow an authorized attacker to gain SQL sysadmin privileges over a network, with a CVSS base score of 8.8. Microsoft's advisory describes it as improper neutralization of special elements in an SQL command. The update applies to supported servicing branches of Microsoft SQL Server 2017, 2019, 2022, and 2025. Content here focuses on the vulnerability details, affected versions, and the required customer action to apply the security update.