Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-67631: pre-auth remote code execution in Microsoft Microsoft SQL Server 2017 (CU 31)

An unauthenticated attacker can execute arbitrary code on Microsoft SQL Server instances by exploiting a heap-based buffer overflow (CVE-2026-67631). The flaw affects multiple SQL Server branches: 2017, 2019, 2022 and 2025 builds before the fixed updates listed by the vendor (see fixed builds). Exploitation requires network access to the SQL Server service but does not require valid credentials or user interaction. The vulnerability is rated critical and allows full system compromise if exploited.

Published Updated Source: CVE Program, NVD, FIRST EPSS, Vendor advisory

CVSS 3.1
9.8CRITICAL
EPSS
0.00974
CWE
CWE-122
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Treat this as urgent: the flaw permits remote code execution without authentication, so prioritize applying the vendor updates that contain the listed fixes or otherwise restrict network exposure to SQL Server immediately.

What is CVE-2026-67631?

An unauthenticated attacker can execute arbitrary code on Microsoft SQL Server instances by exploiting a heap-based buffer overflow (CVE-2026-67631). The flaw affects multiple SQL Server branches: 2017, 2019, 2022 and 2025 builds before the fixed updates listed by the vendor (see fixed builds). Exploitation requires network access to the SQL Server service but does not require valid credentials or user interaction. The vulnerability is rated critical and allows full system compromise if exploited. The weakness is classified as CWE-122 (Heap-based Buffer Overflow).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Microsoft Microsoft SQL Server 2017 (CU 31) are affected?

BRANCHAFFECTEDFIXED
Microsoft SQL Server 2017 (CU 31) 14.x14.0.0 – before 14.0.3550.414.0.3550.4
Microsoft SQL Server 2017 (GDR) 14.x14.0.0 – before 14.0.2130.414.0.2130.4
Microsoft SQL Server 2019 (CU 32) 15.x15.0.0.0 – before 15.0.4490.915.0.4490.9
Microsoft SQL Server 2019 (GDR) 15.x15.0.0 – before 15.0.2190.715.0.2190.7
Microsoft SQL Server 2022 (CU 26) 16.x16.0.0.0 – before 16.0.4275.216.0.4275.2
Microsoft SQL Server 2022 (GDR) 16.x16.0.0 – before 16.0.1200.516.0.1200.5
Microsoft SQL Server 2025 (CU8) 17.x17.0.0.0 – before 17.0.4085.517.0.4085.5
Microsoft SQL Server 2025 for x64-based Systems (GDR) 17.x17.0.1050.2 – before 17.0.1135.817.0.1135.8

Is CVE-2026-67631 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-67631

  1. Apply the vendor updates that include the fixes (for example 14.0.3550.4, 14.0.2130.4, 15.0.4490.9, 15.0.2190.7, 16.0.4275.2, 16.0.1200.5, 17.0.4085.5, 17.0.1135.8).
  2. If you cannot immediately patch, restrict access to SQL Server ports to trusted hosts and networks and block internet exposure.
  3. Monitor SQL Server logs and network traffic for suspicious connections and unexpected processes spawned by sqlservr.exe.
  4. Follow Microsoft’s guidance for installing the updates and rebooting affected systems where required.

Frequently asked questions

Is CVE-2026-67631 being actively exploited?

There are no public reports of exploitation as of 2026-09-30.

Which Microsoft SQL Server versions are affected by CVE-2026-67631?

Multiple branches are affected: Microsoft SQL Server 2017, 2019, 2022 and 2025 builds prior to the fixed builds listed by Microsoft (see fixed versions such as 14.0.3550.4, 15.0.4490.9, 16.0.4275.2, 17.0.4085.5).

Is there a patch for CVE-2026-67631?

Yes. Microsoft published fixes; update to the fixed builds named by Microsoft for your SQL Server branch (examples listed above).

Does CVE-2026-67631 require authentication?

No. The vulnerability can be exploited without authentication; an attacker needs only network access to the SQL Server service.

References