CVE-2026-67636

SQL Server is the database engine many businesses use to store customer and business data. This vulnerability is a flaw that can let an attacker run code on the SQL Server machine from across the network. Think of it like a mistake in how SQL Server reads memory: with the right conditions, it could be turned into a way to take over the server and then access or destroy data.

This matters if your organization runs Microsoft SQL Server at one of the affected build levels listed (2019 CU 32/GDR, 2022 CU 26/GDR, 2025 CU8, or 2025 x64 GDR). Because the weakness is described as requiring an authorized attacker, it’s most likely to be a concern when an attacker can reach SQL Server and has a credible way to obtain or already has authorization (for example, stolen credentials or an overly permissive internal access path). Only treat it as a practical risk when the attacker can reach your SQL Server over the network and the “authorized attacker” condition can be met.

This is RED because it’s a remote code execution issue in Microsoft SQL Server, which means attackers may be able to move from network access to full server compromise. There is no public exploit code on record, and it is not listed in CISA KEV, but the impact is high enough that you should prioritize patching to the fixed builds immediately.