Microsoft SQL Server CVE-2026-67626

Requires valid low-privilege authenticated access (PR:L) to a network-reachable Microsoft SQL Server instance - the attacker must be able to log in and submit requests/queries to the database engine. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Affected builds are Microsoft SQL Server 2022 (CU27 before 16.0.4305.5; GDR before 16.0.1210.3) and SQL Server 2025 (CU9 before 17.0.5015.4; GDR before 17.0.1145.4). The authentication requirement is the primary limiting factor: instances not exposed to untrusted or low-trust accounts (e.g., single-tenant, network-segmented back-end databases) face substantially reduced risk, while hosted, shared, or internet-facing instances with broad login access are more exposed. Impact is confined to availability (service denial); no confidentiality or integrity impact applies.

This is a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity resource-exhaustion flaw (CWE-400) that requires low-privilege authentication (PR:L) and impacts availability only (C:N/I:N - no data compromise). Multiple exploitation signals align toward LOW real-world urgency: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public proof-of-concept. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not a low score. The requirement for valid (low-privilege) credentials materially constrains the attacker population to users who can already authenticate to the SQL Server instance, meaning this is far more relevant to multi-tenant, hosted, or internet-exposed database environments than to well-segmented internal deployments. Bottom line: a genuine but bounded availability risk - worth patching on a normal cadence rather than an emergency one, absent evidence of exploitation.

An attacker who already possesses low-privilege credentials to a reachable SQL Server instance submits specially crafted queries or requests that trigger uncontrolled resource consumption (CPU, memory, or similar), degrading or denying service to legitimate users. No proof-of-concept or active exploitation has been identified, and the low attack complexity (AC:L) means a knowledgeable authenticated user could trigger it reliably without special timing or race conditions.