CVE-2026-67384Important

Microsoft SQL Server Remote Code Execution Vulnerability

Assessment

Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network.

Severity: Important
CVSS base score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Remote Code Execution
EPSS, next 30 days: 0.9%Higher than 58.5% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: SQL Server
Weakness: CWE-190: Integer Overflow or Wraparound
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 8 Sep 2026

8 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122768	Security Update	Required	Microsoft SQL Server 2022 for x64-based Systems (CU 26)	All CVEs in KB5122768
KB5122769	Security Update	Required	Microsoft SQL Server 2025 for x64-based Systems (CU8)	All CVEs in KB5122769
KB5122770	Security Update	Required	Microsoft SQL Server 2025 for x64-based Systems (GDR)	All CVEs in KB5122770
KB5122771	Security Update	Required	Microsoft SQL Server 2022 for x64-based Systems (GDR)	All CVEs in KB5122771
KB5122772	Security Update	Required	Microsoft SQL Server 2019 for x64-based Systems (CU 32)	All CVEs in KB5122772
KB5122773	Security Update	Required	Microsoft SQL Server 2019 for x64-based Systems (GDR)	All CVEs in KB5122773
KB5122774	Security Update	Required	Microsoft SQL Server 2017 for x64-based Systems (CU 31)	All CVEs in KB5122774
KB5122775	Security Update	Required	Microsoft SQL Server 2017 for x64-based Systems (GDR)	All CVEs in KB5122775

SQL Server

8 affected products