CVE-2026-68787 – Microsoft SQL Server 2017 (CU 31)
“Twenty-one flaws in one database engine means every unpatched SQL Server is a front door to your most valuable data.”
This update for Microsoft SQL Server 2017 (CU 31) fixes 21 vulnerabilities. Sixteen of them enable remote code execution, and seven enable elevation of privilege. Two flaws enable both. Most stem from heap-based buffer overflows. The rest come from integer overflows, use-after-free errors, link-following flaws and improper access control. An attacker who exploits these flaws can run code on the database server or gain higher privileges, which puts business-critical data and connected applications at risk.
CVE-2026-67631 has a CVSS score of 9.8, Critical severity. CVE-2026-66818, CVE-2026-67368, CVE-2026-67380, CVE-2026-67381, CVE-2026-67384, CVE-2026-67385, CVE-2026-67388, CVE-2026-67639, CVE-2026-68775, CVE-2026-68786, CVE-2026-73028, CVE-2026-77481, CVE-2026-77482, CVE-2026-77483, CVE-2026-77486, CVE-2026-77487 and CVE-2026-78442 each have a CVSS score of 8.8, High severity. CVE-2026-68787 has a CVSS score of 7.8, High severity. CVE-2026-67376 has a CVSS score of 7.5, High severity. CVE-2026-77485 has a CVSS score of 7.0, High severity.
Key Details
- Affected Product
- Microsoft Sql Server 2017
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-122