CVE-2026-67370

CVE-2026-67370 is a SQL injection flaw (CWE-89) in Microsoft SQL Server in which special elements in attacker-controlled input are not properly neutralized before being used in a SQL command. An authorized attacker holding valid low-privilege credentials can send crafted input over the network (no user interaction required) that is incorporated into a SQL statement, allowing the attacker to elevate privileges on the database server. Successful exploitation has high impact on confidentiality, integrity, and availability of the affected instance (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Any organization running the affected SQL Server versions is potentially exposed, but the specific affected version ranges are not included in the available data and should be confirmed against Microsoft's advisory. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a modest 0.7% probability of exploitation within 30 days (50th percentile).

What to do: Monitor Microsoft's security advisory for the affected version ranges and apply the corresponding SQL Server security or cumulative update as soon as it is published. Until patched, restrict network reachability of SQL Server (firewall TCP 1433, VPN or private endpoints only, no direct internet exposure) and review low-privileged database accounts for excessive permissions. Hunt for anomalous queries or unexpected privilege changes by application and service accounts on any internet-reachable instances.