CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server, rated 8.8 (High) on CVSS 3.1 by Microsoft. A remote attacker who already holds valid low-privileged credentials - an "authorized attacker" per Microsoft - can send crafted input to the database engine over the network to overflow a heap buffer, with no user interaction required. Successful exploitation runs code in the context of the SQL Server process and carries high impact on confidentiality, integrity, and availability, typically meaning full compromise of the affected service. Organizations running Microsoft SQL Server are in scope; the available data does not specify affected version ranges, and fixes were distributed through Microsoft's September 2026 Patch Tuesday, per related Patch Tuesday coverage. There are no known public exploits, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.6% (roughly median) probability of exploitation within 30 days.

What to do: Install the SQL Server security updates from Microsoft's September 2026 Patch Tuesday on all instances, prioritizing any that are internet-facing or reachable on TCP 1433. Because exploitation requires an authorized account, audit low-privileged SQL logins and application service accounts, restrict network exposure of database ports, and monitor using the Snort signatures released alongside the September 2026 updates.