CVE-2026-67643 – Microsoft SQL Server 2022 (CU 26)
CVSS 9.8
CRITICAL
[2] Critical – Same Day Deployment
“When the database falls, the business falls with it. Two heap overflows put SQL Server one step from complete takeover.”
This update fixes two remote code execution vulnerabilities in Microsoft SQL Server 2022 (CU 26). Both flaws are heap-based buffer overflows that let an attacker run code on the database server. CVE-2026-67643 has a CVSS score of 9.8, Critical severity. CVE-2026-78456 has a CVSS score of 8.8, High severity.
SQL Server often holds an organization's most sensitive data and connects to core business applications. A successful attack can expose or change that data, disrupt operations, and give the attacker a foothold to move further into the network. Patch every affected SQL Server 2022 instance today.
Key Details
- Affected Product
- Microsoft Sql Server 2022
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-122
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.