Type Vulnerability
Microsoft · Code execution
Microsoft SQL Server Remote Code Execution Vulnerability
1 sourceCVE-2026-67632
At a glance
Low
30-day window, from the last update
None observed
Evidence-weighted, not popularity
Why Low
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- IT leaders should verify if Microsoft SQL Server is present in their estate and assess potential risks associated with this vulnerability.
Questions to ask IT
- Do we run Microsoft Sql Server, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-67632- 8.8 · HighExploitable over the network with a low-privilege account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Not listed
- Not linked from the CVE record
- The vulnerability involves a heap-based buffer overflow in SQL Server that could enable code execution by an authorised attacker over a network.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- A heap-based buffer overflow in Microsoft SQL Server could allow an authorised attacker to execute code over a network.
Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)
Products and services involved
- Microsoft Sql Server98% match confidence · CVE-2026-67632
19 reports
Part of Multiple Microsoft Windows vulnerabilities disclosed
Pulse
Last change 56m ago · Next recheck 11 Nov 2026, 19:06 UK time
- Story10 Nov 2026, 19:06 UK time · 56m ago
Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).
Read source (Microsoft Security Update Guide RSS)
1 entry so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-67632 Microsoft SQL Server Remote Code Execution Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Microsoft SQL Server Remote Code Execution Vulnerability
- ProbableSummary fact75% confidence
Heap-based buffer overflow in SQL Server allows an authorised attacker to execute code over a network.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-67632