CVE-2026-67368

HIGH 8.8CVE-2026-67368 · Published 08/09/2026 · updated 15/09/2026

In short

CVE-2026-67368 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.5% of all vulnerabilities.
Fix: update to 14.0.3550.4, 14.0.2130.4, 15.0.4490.9, 15.0.2190.7 or later.

Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2026-67368 is a HIGH (CVSS 8.8) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.5% of all vulnerabilities.

Fix: update to 14.0.3550.4, 14.0.2130.4, 15.0.4490.9, 15.0.2190.7 or later.

Package

Affected versions

Patched versions

≥ 14.0.3006.16, < 14.0.3550.4< 14.0.2130.4

14.0.3550.414.0.2130.4

≥ 15.0.4003.23, < 15.0.4490.9< 15.0.2190.7

15.0.4490.915.0.2190.7

≥ 16.0.4003.1, < 16.0.4275.2< 16.0.1200.5

16.0.4275.216.0.1200.5

≥ 17.0.4006.2, < 17.0.4085.5< 17.0.1135.8

17.0.4085.517.0.1135.8

More vulnerabilities in sql server 2017

See all →