Microsoft SQL Server CVE-2026-67380

Exploitation requires a valid SQL Server authentication credential (SQL login, Windows-authenticated account, or any account granted CONNECT permission to the targeted database instance). The SQL Server TDS listener must be reachable over the network from the attacker, which is the default configuration when SQL Server is installed. No specific non-default feature or configuration beyond basic network connectivity and a low-privileged account is required. Limiting factors: the attacker must possess or obtain valid credentials before exploiting; SQL Server instances not exposed to untrusted network segments face reduced risk; environments using Windows Firewall or network-level access controls restricting port 1433 to known application servers reduce the attack surface meaningfully.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-justified: the attack is network-reachable, requires no user interaction, has low complexity, and yields full C/I/A compromise on the SQL Server process. The primary limiting factor is the PR:L requirement - exploitation demands a valid credential, which is a meaningful bar in well-hardened environments but a low bar wherever shared or weak credentials are in use. The EPSS score is not provided in the input data, preventing probabilistic exploitation likelihood assessment. No CISA KEV listing is present, and no POC availability is indicated, meaning active exploitation is not confirmed at time of analysis. Even so, the combination of low complexity, broad version coverage across four major SQL Server generations, and high-impact outcome means that even a mid-sized organization running SQL Server in an internal network segment should treat this as urgent patching, given the realistic risk of a low-privileged account being leveraged for database server takeover. The absence of Scope change (S:U) suggests that exploitation is confined to the SQL Server process itself, though SQL Server often runs with elevated OS privileges (Network Service or Local System), amplifying post-exploitation impact.

An attacker with a valid low-privileged SQL Server login - such as an application service account credential obtained through phishing or credential stuffing - connects to the SQL Server TDS listener over the network and sends a specially crafted query or protocol message that triggers the heap buffer overflow. The overflow corrupts heap metadata or function pointers, redirecting execution flow to attacker-controlled shellcode or ROP chain, ultimately achieving code execution under the SQL Server process identity. No public proof-of-concept has been identified at time of analysis, though low attack complexity suggests exploitation is within reach of skilled adversaries.