CVE-2026-67378

Microsoft SQL Server contains an untrusted pointer dereference (CWE-822), a memory-safety flaw in which the database engine dereferences a pointer derived from untrusted input. It is triggered remotely by an authorized, low-privileged attacker whose input causes the engine to follow the invalid pointer; the high attack complexity (AC:H) in the CVSS vector means successful exploitation depends on specific runtime conditions. A successful attacker gains remote code execution, and the changed-scope (S:C) designation plus high confidentiality, integrity, and availability scores indicate code may execute beyond the SQL Server service's normal security context with severe impact. Any organization running affected Microsoft SQL Server builds is exposed, though the available data does not specify affected version ranges, so defenders should consult Microsoft's advisory for exact builds. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known, and EPSS estimates only a 0.5% probability of exploitation within the next 30 days.

What to do: Apply the security updates released in Microsoft's September 2026 Patch Tuesday for SQL Server, prioritizing internet-facing and multi-tenant instances, and confirm your installed builds against the affected ranges in Microsoft's advisory. Since exploitation requires an authorized account, restrict TCP 1433 to trusted networks, minimize and rotate SQL logins, and enforce least-privilege database roles. Monitor Microsoft's advisory for updated version information and any changes in exploitation status.