Microsoft SQL Server CVE-2026-67636

Exploitation targets Microsoft SQL Server 2019 (builds before 15.0.2190.7 GDR / 15.0.4490.9 CU32), SQL Server 2022 (before 16.0.1200.5 GDR / 16.0.4275.2 CU26), and SQL Server 2025 (before 17.0.1135.8 GDR / 17.0.4085.5 CU8) on x64. The CVSS vector states PR:N/UI:N (no authentication, no user interaction), but the description's phrase 'authorized attacker' indicates a valid database connection/low-privilege account is realistically required - a meaningful limiting factor since SQL Server is typically not internet-exposed. High attack complexity (AC:H) further limits reliable exploitation, as the OOB read must be steered into code execution under specific memory conditions. Realistic exposure is highest where SQL Server accepts connections from untrusted or semi-trusted network segments.

This is a high-CVSS (9.0) SQL Server flaw where a code-quality bug (CWE-125 out-of-bounds read) is claimed by Microsoft to enable remote code execution with total technical impact (C:H/I:H/A:H, S:C). However, multiple signals argue against treating it as an immediate emergency. The CVSS vector carries AC:H, meaning exploitation is not straightforward and likely requires specific memory-layout conditions or timing. EPSS is low at 0.47% (40th percentile), and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' - consistent with no public exploit identified at time of analysis. A patch is already available from Microsoft. There is a notable internal conflict: the CVSS vector states PR:N (unauthenticated) while the description says 'authorized attacker,' which implies some authenticated access is actually required; Microsoft's Update Guide routinely encodes 'authorized attacker' scenarios yet publishes PR:N, so the true prerequisite is very likely low-privilege authentication rather than fully anonymous access - verify with the MSRC advisory. Net: a genuinely serious flaw worth prompt patching in exposed SQL Server estates, but the combination of AC:H, low EPSS, no known exploitation, and 'automatable: no' places it below internet-facing, PR:N/AC:L RCEs in triage priority.

An attacker with the ability to authenticate to or submit crafted input to an affected SQL Server 2019/2022/2025 instance sends specially crafted data that triggers an out-of-bounds read in a parsing/processing path. By controlling adjacent memory, the attacker leverages the read primitive into code execution in the SQL Server process context, with the CVSS scope change (S:C) implying impact beyond the immediate component. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) suggests non-trivial exploitation.