CVE-2026-67643 – Microsoft SQL Server Remote Code Execution Vulnerability
CVSS 8.8
IMPORTANT
Critical - Same Day Deployment
“A specially crafted SQL request can turn authenticated database access into remote code execution, putting sensitive data and critical server operations at risk.”
CVE-2026-67643 is a Critical heap-based buffer overflow vulnerability affecting Microsoft SQL Server 2022 and SQL Server 2025. An authenticated attacker with low privileges can connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution on the server. The vulnerability can be attacked over the network with low complexity and requires no user interaction.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-122
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.