CVE-2026-67368: SQL Server Privilege Escalation Vulnerability

CVE-2026-67368 Overview

CVE-2026-67368 is a link-following vulnerability [CWE-59] in Microsoft SQL Server. An authorized attacker can abuse improper link resolution before file access to elevate privileges over a network. The flaw permits an authenticated user with low privileges to redirect file operations performed by SQL Server to unintended targets through symbolic links or junctions.

Microsoft published the advisory through the Microsoft Security Response Center. The vulnerability affects confidentiality, integrity, and availability of the database service and its host.

Critical Impact
An authenticated network attacker can escalate privileges on affected SQL Server instances, gaining higher-privileged access to database data and the underlying host process context.

Affected Products

Microsoft SQL Server (versions listed in the vendor advisory)
Deployments where SQL Server processes attacker-influenced file paths
Windows hosts running vulnerable SQL Server builds

Discovery Timeline

2026-09-08 - CVE-2026-67368 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67368

Vulnerability Analysis

The vulnerability sits in SQL Server's file access logic. Before opening a file, the service fails to properly resolve links, allowing symbolic links, junctions, or hard links to redirect operations. An authenticated attacker with database-level access can plant a link that points to a sensitive file. When SQL Server accesses the path using its elevated service account, the operation follows the link and touches the attacker-chosen target.

The issue is classified under CWE-59, Improper Link Resolution Before File Access. Successful exploitation yields high impact across confidentiality, integrity, and availability. The attack is network-reachable and requires only low privileges with no user interaction.

The EPSS probability is 0.705% as of 2026-09-10, indicating limited near-term exploitation prediction. No public exploit or CISA KEV listing exists at publication.

Root Cause

The defect stems from SQL Server opening or writing to file paths without verifying that intermediate path components are not links controlled by a lower-privileged principal. This TOCTOU-adjacent behavior allows a low-privileged user to influence which file the service ultimately touches. The service account performs the I/O with its own credentials, not those of the caller.

Attack Vector

An attacker authenticates to SQL Server with a low-privileged account. The attacker stages a symbolic link, junction, or hard link in a location the SQL Server process later accesses. When SQL Server performs a file operation such as backup, restore, log write, or extended stored procedure I/O, it follows the link. The operation reads or writes a file the attacker could not otherwise reach.

For exploitation specifics, refer to the Microsoft Security Update Guide for CVE-2026-67368. No verified public proof-of-concept is available.

Detection Methods for CVE-2026-67368

Indicators of Compromise

Unexpected creation of symbolic links, junctions, or hard links in directories accessed by the SQL Server service account.
SQL Server error log entries referencing file access outside expected data, log, or backup directories.
Backup, restore, or BULK INSERT operations writing to or reading from paths not owned by the invoking principal.
New or modified extended stored procedures and CLR assemblies that reference filesystem paths.

Detection Strategies

Monitor Windows Security event ID 4663 for file object access performed by the SQL Server service account against sensitive paths.
Audit SQL Server for use of xp_cmdshell, BACKUP DATABASE, and file-oriented statements originating from non-administrative logins.
Alert on Sysmon event ID 11 (FileCreate) and event ID 2 (FileCreationTime) for reparse points created by SQL Server child processes.
Correlate authentication events with subsequent filesystem operations to spot low-privileged logins that trigger high-privilege file writes.

Monitoring Recommendations

Enable SQL Server audit specifications capturing SERVER_FILE_PERMISSION_CHANGE_GROUP and file-related actions.
Forward SQL Server error logs and Windows security logs to a centralized analytics platform for correlation.
Baseline normal file access patterns for the SQL Server service account and alert on deviations.

How to Mitigate CVE-2026-67368

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-67368 to all affected SQL Server instances.
Inventory SQL Server instances exposed to untrusted networks or hosting low-privileged logins and prioritize them for patching.
Rotate credentials for SQL Server logins that may have been used to stage link-based abuse.
Review recent backup, restore, and file I/O activity for anomalous target paths.

Patch Information

Microsoft has released updates through the Microsoft Security Update Guide. Consult the vendor advisory for CVE-2026-67368 for the specific KB articles, cumulative updates, and build numbers that address the flaw across supported SQL Server versions.

Workarounds

Restrict SQL Server logins to the least privileges required and remove unnecessary db_owner and sysadmin membership.
Deny filesystem write access for the SQL Server service account on directories outside dedicated data, log, and backup locations.
Disable xp_cmdshell and other file-oriented extended stored procedures where they are not required.
Configure NTFS permissions so low-privileged principals cannot create reparse points inside directories consumed by SQL Server.

bash

# Example: disable xp_cmdshell to reduce file-oriented attack surface
sqlcmd -S <server> -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"