CVE-2026-68785

MEDIUM 4.9CVE-2026-68785 · Published 08/09/2026 · updated 15/09/2026

In short

CVE-2026-68785 is a MEDIUM (CVSS 4.9) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.3% of all vulnerabilities.
Fix: update to 14.0.3550.4, 14.0.2130.4, 15.0.4490.9, 15.0.2190.7 or later.

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2026-68785 is a MEDIUM (CVSS 4.9) vulnerability affecting sql server 2017 (microsoft), sql server 2019 (microsoft), sql server 2022 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.3% of all vulnerabilities.

Fix: update to 14.0.3550.4, 14.0.2130.4, 15.0.4490.9, 15.0.2190.7 or later.

Package

Affected versions

Patched versions

≥ 14.0.3006.16, < 14.0.3550.4< 14.0.2130.4

14.0.3550.414.0.2130.4

≥ 15.0.4003.23, < 15.0.4490.9< 15.0.2190.7

15.0.4490.915.0.2190.7

≥ 16.0.4003.1, < 16.0.4275.2< 16.0.1200.5

16.0.4275.216.0.1200.5

≥ 17.0.4006.2, < 17.0.4085.5< 17.0.1135.8

17.0.4085.517.0.1135.8

More vulnerabilities in sql server 2017

See all →