CVE-2026-67636 – Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-67636 is a critical remote code execution vulnerability in Microsoft SQL Server caused by an out-of-bounds read. An authenticated attacker with low privileges could connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers a memory corruption condition. Successful exploitation could allow code execution on the server and result in high confidentiality, integrity, and availability impact. Exploitation requires specific conditions because attack complexity is high, and no user interaction is required.

CVSS SCORE: 8.5.

SEVERITY: Critical.

THREAT: An authorized attacker could target a vulnerable SQL Server remotely and attempt to trigger memory corruption through a specially crafted query or request. Successful exploitation could lead to remote code execution with high impact to the confidentiality, integrity, and availability of the affected system.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. The exploitability assessment is Exploitation Unlikely, and exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-67636 is an out-of-bounds read vulnerability, classified as CWE-125, in Microsoft SQL Server. An authenticated attacker can connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers a memory corruption condition. Successful exploitation can result in remote code execution. Attack complexity is high because particular protocol settings, configurations, or other specific conditions must be present for an attack to succeed. Authentication and low privileges are required, but user interaction is not required. The vulnerability has changed scope and carries high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2019 x64 (CU 32 and GDR), SQL Server 2022 x64 (CU 26 and GDR), and SQL Server 2025 x64 (CU8 and GDR). An authenticated, low-privileged attacker could exploit the issue over the network using a specially crafted query or request under the required conditions.

BUSINESS IMPACT: Successful exploitation could allow an attacker with authorized SQL Server access to execute code remotely, potentially compromising sensitive information, changing data, and disrupting database availability. For organizations that depend on SQL Server for critical applications and business data, server compromise could lead to significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected SQL Server updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no exploitation is currently identified, affected SQL Server installations should be prioritized for patching because no workaround or mitigation is identified.