CVE-2026-68775

CVE-2026-68775 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server that can be reached over the network by an attacker who already holds low-privilege (authorized) credentials. By sending crafted input that the database engine mishandles in heap memory, the attacker can corrupt adjacent memory and trigger remote code execution in the context of the SQL Server process. Because the CVSS impact ratings for confidentiality, integrity, and availability are all high, successful exploitation gives the attacker substantial control over the database server, potentially exposing stored data and enabling further lateral movement. Any organization running an affected release of Microsoft SQL Server is in scope; the advisory data does not specify version ranges. Exploitation has not been observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.5% chance of exploitation within 30 days.

What to do: Track Microsoft's advisory and apply the security update for affected SQL Server releases as soon as version-specific guidance is published. In the meantime, restrict network access to SQL Server (e.g., limit TCP port 1433 to trusted hosts), audit which low-privilege accounts can authenticate remotely, and monitor database servers for anomalous process behavior.