CVE-2026-68787
Status: AnalyzedHigh (7.8)—
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.33%
- Percentile among all scored CVEs: 24
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1068Exploitation for Privilege Escalationprivilege escalation95 % - Primary impact
T1059Command and Scripting Interpreterexecution90 %
Vector CVSS AV:L/PR:L/UI:N indica acceso local con privilegios; heap buffer overflow permite ejecución de código arbitrario en el contexto del proceso SQL Server.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (4)
CWEs
- CWE-122
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-68787",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-68787",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-09-09T04:24:41.361141Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (CU 31)",
"versions": [
{
"status": "affected",
"version": "14.0.0",
"lessThan": "14.0.3550.4",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2017 (GDR)",
"versions": [
{
"status": "affected",
"version": "14.0.0",
"lessThan": "14.0.2130.4",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (CU 32)",
"versions": [
{
"status": "affected",
"version": "15.0.0.0",
"lessThan": "15.0.4490.9",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2019 (GDR)",
"versions": [
{
"status": "affected",
"version": "15.0.0",
"lessThan": "15.0.2190.7",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 (CU 26)",
"versions": [
{
"status": "affected",
"version": "16.0.0.0",
"lessThan": "16.0.4275.2",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2022 (GDR)",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.0.1200.5",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 (CU8)",
"versions": [
{
"status": "affected",
"version": "17.0.0.0",
"lessThan": "17.0.4085.5",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SQL Server 2025 for x64-based Systems (GDR)",
"versions": [
{
"status": "affected",
"version": "17.0.1050.2",
"lessThan": "17.0.1135.8",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
}
]
}
],
"published": "2026-09-08T18:18:26.313",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68787",
"tags": [
"Vendor Advisory",
"Patch"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally."
}
],
"lastModified": "2026-09-15T20:00:14.277",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "3207B09A-49E7-43D5-88B6-6ECF886B2E96",
"versionEndExcluding": "14.0.2130.4"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "E409F829-1995-4F4F-9103-F718E929C482",
"versionEndExcluding": "14.0.3550.4",
"versionStartIncluding": "14.0.3006.16"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "799073C2-2213-4F34-8F07-D6C10AC00578",
"versionEndExcluding": "15.0.2190.7"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "5517BD13-C554-4318-8D4F-FBCC90A628DB",
"versionEndExcluding": "15.0.4490.9",
"versionStartIncluding": "15.0.4003.23"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "21EA6405-BD37-4487-85FD-1B9CCCCF93F0",
"versionEndExcluding": "16.0.1200.5"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "C76C3735-9E01-4F1A-98D3-29B9072C69D2",
"versionEndExcluding": "16.0.4275.2",
"versionStartIncluding": "16.0.4003.1"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "4117EB69-994D-4A8D-85EC-5AC12DF66DBD",
"versionEndExcluding": "17.0.1135.8"
},
{
"criteria": "cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "1408DECC-BC22-4F27-8C49-C608FBF27FED",
"versionEndExcluding": "17.0.4085.5",
"versionStartIncluding": "17.0.4006.2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}