CVE-2026-67370: SQL Server SQL Injection Vulnerability

CVE-2026-67370 Overview

CVE-2026-67370 is a SQL injection vulnerability in Microsoft SQL Server that allows an authenticated attacker to elevate privileges over a network. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. An attacker with low-privileged database access can inject crafted SQL statements to gain higher-privileged execution context on the server.

Critical Impact
Successful exploitation grants an authorized attacker elevated privileges on the SQL Server instance, compromising confidentiality, integrity, and availability of database contents.

Affected Products

Microsoft SQL Server (see the Microsoft CVE-2026-67370 Advisory for specific affected builds)

Discovery Timeline

2026-09-08 - CVE CVE-2026-67370 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67370

Vulnerability Analysis

CVE-2026-67370 is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. The vulnerability exists in a code path within SQL Server that accepts user-supplied input and incorporates it into a database query without adequate sanitization or parameterization. An authenticated attacker with network access to the database can submit crafted input that breaks out of the intended query context.

Once the injection succeeds, the attacker executes arbitrary SQL statements in the context of a higher-privileged principal. This enables privilege escalation within the database engine and can lead to unauthorized reads, writes, and administrative operations on the instance.

The EPSS probability for this CVE is 0.668%, indicating a relatively low near-term exploitation forecast. However, SQL injection flaws in database engines historically attract targeted exploitation because they yield direct data access.

Root Cause

The root cause is missing or insufficient neutralization of special characters before including attacker-controlled input in an SQL statement. When input passes into the query builder unescaped, the parser treats injected tokens as part of the command structure rather than as data, allowing the attacker to alter query semantics.

Attack Vector

The attack vector is network-based and requires the attacker to hold valid low-privileged credentials to the SQL Server instance. No user interaction is required. The attacker delivers a malicious payload through a parameter processed by the vulnerable code path, and the injected SQL executes with elevated privileges.

Refer to the Microsoft CVE-2026-67370 Advisory for details on the affected component and query surface.

Detection Methods for CVE-2026-67370

Indicators of Compromise

Unexpected SQL statements in sys.dm_exec_query_stats or Extended Events sessions that contain concatenated string fragments, comment sequences such as --, or UNION SELECT clauses submitted by low-privileged accounts.
Sudden role membership changes, new logins, or GRANT statements originating from application service accounts.
Failed logins followed by successful authentication and immediate execution of administrative stored procedures.

Detection Strategies

Enable SQL Server Audit to capture SCHEMA_OBJECT_ACCESS_GROUP and DATABASE_PRINCIPAL_CHANGE_GROUP events for review of privilege-relevant actions.
Deploy Extended Events sessions that flag queries containing common injection patterns from application-tier logins.
Correlate application access logs with database query logs to identify parameter values that produce anomalous query plans.

Monitoring Recommendations

Alert on any use of sp_addsrvrolemember, sp_addrolemember, or ALTER SERVER ROLE from non-DBA principals.
Monitor for outbound network activity from the SQL Server host that deviates from baseline, which can indicate post-exploitation staging.
Track query execution volume and error rates per login to surface probing behavior consistent with injection discovery.

How to Mitigate CVE-2026-67370

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-67370 Advisory to all affected SQL Server instances.
Inventory database logins and remove or restrict accounts that no longer require access to the instance.
Rotate credentials for application service accounts that connect to SQL Server, particularly those used by internet-facing applications.

Patch Information

Microsoft has published a security update for CVE-2026-67370. Consult the Microsoft CVE-2026-67370 Advisory for the applicable build numbers, download links, and installation guidance for each supported SQL Server version.

Workarounds

Restrict network reachability of SQL Server to trusted application hosts using firewall rules or network security groups.
Enforce least privilege on application service accounts so that a successful injection yields minimal additional access.
Require parameterized queries and stored procedures in application code that interacts with SQL Server, and reject dynamic SQL built through string concatenation.