Medium · 6.5 CVE-2026-67626 EUVD-2026-100606GHSA-w7cx-4jpr-vh3m

Microsoft SQL Server Denial of Service Vulnerability

Published Oct 13, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft SQL Server 2022 (GDR) Product: Microsoft SQL Server 2022 for x64-based Systems (CU27) Product: Microsoft SQL Server 2025 for x64-based Systems (CU9) Product: Microsoft SQL Server 2025 for x64-based Systems (GDR)

Description

Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft SQL Server 2022 (GDR)	16.0.0 – < 16.0.1210.3	16.0.1210.3
Microsoft	Microsoft SQL Server 2022 for x64-based Systems (CU27)	16.0.4003.1 – < 16.0.4305.5	16.0.4305.5
Microsoft	Microsoft SQL Server 2025 for x64-based Systems (CU9)	17.0.4006.2 – < 17.0.5015.4	17.0.5015.4
Microsoft	Microsoft SQL Server 2025 for x64-based Systems (GDR)	17.0.1050.2 – < 17.0.1145.4	17.0.1145.4

Advisories 3

WID-SEC-2026-3917 Microsoft SQL Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026
NCSC-2026-0420 Kwetsbaarheden verholpen in Microsoft SQL Server NCSC-NL (Netherlands) · Oct 13, 2026
MSRC-CVE-2026-67626 Microsoft SQL Server Denial of Service Vulnerability Microsoft Security Response Center · Oct 13, 2026

References

Microsoft SQL Server Denial of Service Vulnerability vendor-advisory patch