Microsoft SQL Server remote code execution lets unauthenticated attackers run code over the network (CVE-2026-67378)

What happened

Microsoft describes CVE-2026-67378 as a remote code execution vulnerability caused by an untrusted pointer dereference in SQL Server (CWE-822). An attacker who can reach an affected SQL Server over the network can exploit the flaw without credentials and without a user being tricked into doing anything. Microsoft rates the issue critical, with a CVSS v3.1 score of 9 and high impact for confidentiality, integrity and availability. Attack complexity is high, so successful exploitation is not straightforward, but the resulting compromise is total. No active exploitation or public disclosure is recorded in the advisory.

Who is affected

The affected products are Microsoft SQL Server 2019, 2022 and 2025, in both CU and GDR servicing branches:

• SQL Server 2019 (CU): version 15.0.0.0 to before 15.0.4490.9
• SQL Server 2019 (GDR): version 15.0.0 to before 15.0.2190.7
• SQL Server 2022 (CU): version 16.0.0.0 to before 16.0.4275.2
• SQL Server 2022 (GDR): version 16.0.0 to before 16.0.1200.5
• SQL Server 2025 (CU8): version 17.0.0.0 to before 17.0.4085.5
• SQL Server 2025 for x64-based Systems (GDR): version 17.0.1050.2 to before 17.0.1135.8

SQL Server is a database platform commonly used for line-of-business applications. Instances reachable from client networks, web servers or remote offices are in scope, particularly where the database service is exposed beyond trusted segments.

What to do now

1. Patch first. Identify whether your installations use the CU branch or the GDR branch and apply the applicable Microsoft fixed build from the September 2026 security update:

• SQL Server 2019 CU: 15.0.4490.9 (KB5122772)
• SQL Server 2019 GDR: 15.0.2190.7 (KB5122773)
• SQL Server 2022 CU: 16.0.4275.2 (KB5122768)
• SQL Server 2022 GDR: 16.0.1200.5 (KB5122771)
• SQL Server 2025 CU8: 17.0.4085.5 (KB5122769)
• SQL Server 2025 for x64-based Systems GDR: 17.0.1135.8 (KB5122770)

1. Verify the SQL Server version after installation to confirm it is at or above the fixed build for your servicing branch.
2. Microsoft has not published a workaround. While you schedule patching, restrict network access to SQL Server to authorised hosts and review connection activity for unexpected attempts.

How to detect it

Microsoft's advisory does not provide specific indicators of compromise. Because this is a network-exploitable, unauthenticated issue, begin by identifying SQL Server instances that accept connections from untrusted segments, such as services exposed to the internet or unnecessarily broad internal network ranges. Confirm that only expected application and administrator paths can reach them.

Beyond the patch

SQL Server is rarely an island; it is reached by applications, reporting tools and remote staff, so the real exposure is often a forgotten network path rather than the database itself. Our Virtual CISO Services (vCISO) help map and close that network exposure before an update falls behind, while Managed Detection & Response (MDR) monitors for the post-exploitation activity — unusual code execution, privileged access and lateral movement — that a successful SQL Server compromise would generate. Patch this one now, then apply the same exposure and detection discipline to the next one.