Denial of Service Vulnerability in Microsoft SQL Server
CVE-2026-67626

6.5MEDIUM

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2022 (gdr); Microsoft Sql Server 2022 For X64-based Systems (cu27); Microsoft Sql Server 2025 For X64-based Systems (cu9); Microsoft Sql Server 2025 For X64-based Systems (gdr)
Vendor: CVE Published:; 13 October 2026

What is CVE-2026-67626?

An uncontrolled resource consumption vulnerability in Microsoft SQL Server enables an authorized attacker to disrupt services across a network. By exploiting this flaw, attackers can initiate excessive resource usage in affected SQL Server implementations, leading to potential service interruptions and degraded performance for legitimate users.

Affected Version(s)

Microsoft SQL Server 2022 (GDR) x64-based Systems 16.0.0 < 16.0.1210.3

Microsoft SQL Server 2022 for x64-based Systems (CU27) x64-based Systems 16.0.4003.1 < 16.0.4305.5

Microsoft SQL Server 2025 for x64-based Systems (CU9) x64-based Systems 17.0.4006.2 < 17.0.5015.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 13, 2026
Vulnerability Reserved
Jul 29, 2026

CVE-2026-67626 Data

JSON