Microsoft SQL Server CVE-2026-67639

Exploitation requires a valid SQL Server login with at minimum low-privilege authentication (PR:L per CVSS vector). The attacker must be able to reach the SQL Server network port (default TCP 1433) from their position. No elevated database roles, stored-procedure execute rights, or special server configuration have been documented as required beyond a basic authenticated session. What limits exploitation: the attacker must first possess valid credentials to the target instance, eliminating fully unauthenticated remote attacks. Environments that restrict SQL Server access to application tiers via firewall rules and rotate service-account credentials regularly face meaningfully reduced exposure.

The CVSS 8.8 score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic threat model: authenticated low-privilege network access with full CIA impact. The key limiting factor is PR:L - the attacker must possess valid SQL Server credentials, which substantially narrows the exploitable population compared to a PR:N vulnerability. Nevertheless, SQL Server environments routinely expose service accounts, application database users, and developer credentials that attackers can obtain through phishing, credential-stuffing, or lateral movement. No EPSS data was provided; no CISA KEV listing exists; and no public exploit code has been identified, keeping real-world exploitation probability moderate rather than imminent. Despite the absence of active exploitation signals, the combination of network reachability, low complexity once credentials are obtained, and full code-execution impact on a typically privileged service warrants treating this as high priority for enterprise SQL Server operators.

An attacker who has obtained low-privilege SQL Server credentials - through phishing, credential reuse, or a compromised application service account - connects to an internet- or intranet-facing SQL Server instance over TCP and submits a specially crafted query or protocol-level message that triggers the heap overflow. Successful exploitation causes memory corruption that redirects SQL Server execution flow, yielding code execution in the context of the SQL Server service account. No public exploit code has been identified at time of analysis.