Microsoft SQL Server out-of-bounds read allows unauthenticated remote code execution (CVE-2026-67636)

What happened

Microsoft has disclosed CVE-2026-67636, an out-of-bounds read in SQL Server. In Microsoft's description, an unauthorized attacker can trigger the flaw over a network to execute code. The CVSS 3.1 vector rates the vulnerability 9.0 Critical: the attack is network-based, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability with a change of scope. The vector also records high attack complexity.

Microsoft has not said that this vulnerability has been exploited in the wild, and the CVE record does not indicate public disclosure. There is no CISA KEV entry for CVE-2026-67636.

Who is affected

All three current servicing branches of SQL Server are affected: 2019, 2022 and 2025, in both CU and GDR tracks. SQL Server is a relational database platform that commonly holds business-critical data; instances are usually deployed on internal networks, but some organisations expose them to client applications or the internet.

Affected version ranges are:

• Microsoft SQL Server 2019 (CU 32): 15.0.0.0 to before 15.0.4490.9
• Microsoft SQL Server 2019 (GDR): 15.0.0 to before 15.0.2190.7
• Microsoft SQL Server 2022 (CU 26): 16.0.0.0 to before 16.0.4275.2
• Microsoft SQL Server 2022 (GDR): 16.0.0 to before 16.0.1200.5
• Microsoft SQL Server 2025 (CU8): 17.0.0.0 to before 17.0.4085.5
• Microsoft SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to before 17.0.1135.8

What to do now

1. Apply the Microsoft security update for your SQL Server servicing branch. Fixed builds are:

• SQL Server 2019 (GDR): 15.0.2190.7 — KB5122773
• SQL Server 2019 (CU 32): 15.0.4490.9 — KB5122772
• SQL Server 2022 (GDR): 16.0.1200.5 — KB5122771
• SQL Server 2022 (CU 26): 16.0.4275.2 — KB5122768
• SQL Server 2025 (x64 GDR): 17.0.1135.8 — KB5122770
• SQL Server 2025 (CU8): 17.0.4085.5 — KB5122769

1. If you cannot patch immediately, restrict network access to SQL Server to trusted hosts only and review whether any instance is reachable from untrusted networks. Microsoft has not published a workaround for this CVE.
2. After patching, verify the running build number on each instance matches the fixed version for its branch.

How to detect it

Microsoft's advisory does not list indicators of compromise for CVE-2026-67636. The most reliable check is an accurate inventory of SQL Server build numbers against the fixed versions above. Review network reachability to SQL Server instances; an unauthenticated network attack is the exposure model, so instances that accept connections from unexpected hosts deserve priority.

Beyond the patch

SQL Server is easy to treat as an internal-only service, but this vulnerability is a reminder that unauthenticated network reachability is itself the first condition to manage. A database server that should not be reachable from untrusted segments is an exposure problem before it is a patch problem. Virtual CISO Services can help you map and reduce that network exposure. If code execution does occur, Managed Detection & Response provides the EDR and SIEM monitoring that turns post-exploitation activity into a detected incident.