CVE-2026-67630Important

Microsoft SQL Server Information Disclosure Vulnerability

Assessment

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Severity: Important
CVSS base score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Impact: Information Disclosure
EPSS, next 30 days: 1.0%Higher than 61.1% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: SQL Server
Weakness: CWE-125: Out-of-bounds Read
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 8 Sep 2026

8 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122768	Security Update	Required	Microsoft SQL Server 2022 for x64-based Systems (CU 26)	All CVEs in KB5122768
KB5122769	Security Update	Required	Microsoft SQL Server 2025 for x64-based Systems (CU8)	All CVEs in KB5122769
KB5122770	Security Update	Required	Microsoft SQL Server 2025 for x64-based Systems (GDR)	All CVEs in KB5122770
KB5122771	Security Update	Required	Microsoft SQL Server 2022 for x64-based Systems (GDR)	All CVEs in KB5122771
KB5122772	Security Update	Required	Microsoft SQL Server 2019 for x64-based Systems (CU 32)	All CVEs in KB5122772
KB5122773	Security Update	Required	Microsoft SQL Server 2019 for x64-based Systems (GDR)	All CVEs in KB5122773
KB5122774	Security Update	Required	Microsoft SQL Server 2017 for x64-based Systems (CU 31)	All CVEs in KB5122774
KB5122775	Security Update	Required	Microsoft SQL Server 2017 for x64-based Systems (GDR)	All CVEs in KB5122775

SQL Server

8 affected products