CVE-2026-67368

Microsoft SQL Server contains a 'link following' flaw (CWE-59): the database engine improperly resolves symbolic or hard links before opening files, opening the door to file access outside the intended location. An authorized attacker who already holds low-privileged network access to the instance can trigger the faulty link resolution and leverage the resulting privileged file operations. The attacker gains elevation of privilege on the affected SQL Server system, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Any SQL Server deployment reachable over the network by low-privileged users is potentially affected; the available data does not specify which version ranges are impacted, so operators should consult Microsoft's advisory for applicability. As of now there is no known exploitation: the flaw is not in CISA KEV, EPSS assigns a 0.7% 30-day exploitation probability (51st percentile), and no public proof-of-concept is known.

What to do: Apply the SQL Server security update referenced by this CVE in Microsoft's advisory as soon as it is available, prioritizing instances reachable by non-administrative users. In the interim, restrict which low-privileged accounts can create or modify symbolic/hard links and file paths used by SQL Server (e.g., database or backup directories), and limit network exposure of the instance by restricting port 1433 to trusted hosts. Review vendor advisory text to confirm which of your SQL Server versions and configurations are affected, since version ranges are not enumerated in the summary data.