CRITICAL 9.0 Microsoft

CVE-2026-67378

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft Security Update 2026-Sep: Microsoft SQL Server Remote Code Execution Vulnerability

Affected Products

Microsoft SQL Server 2019 for x64-based Systems (GDR)
Microsoft SQL Server 2022 for x64-based Systems (GDR)
Microsoft SQL Server 2025 for x64-based Systems (GDR)
Microsoft SQL Server 2019 for x64-based Systems (CU 32)
Microsoft SQL Server 2025 for x64-based Systems (CU8)
Microsoft SQL Server 2022 for x64-based Systems (CU 26)

References

Published: 2026-09-08 · Source: Microsoft · Feed updated: 2026-10-27

This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-09-08 via Microsoft. Affected: Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (GDR) and 3 more.

Risk Timeline

CVE Disclosed2026-09-08 · 48 days ago

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67378

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-67378

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2026-96207	Microsoft Partner Center Elevation of Privilege Vulnerability	CRITICAL	10.0
CVE-2026-63508	Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability	CRITICAL	10.0
CVE-2026-65667	Microsoft Teams Elevation of Privilege Vulnerability	CRITICAL	10.0
CVE-2026-65801	Microsoft Exchange Online Elevation of Privilege Vulnerability	CRITICAL	10.0
CVE-2026-69836	Microsoft Entra ID Remote Code Execution Vulnerability	CRITICAL	10.0
CVE-2026-56191	Microsoft Exchange Online Tampering Vulnerability	CRITICAL	10.0

vulnfeed aggregates 18513 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.