CVE-2026-67626: SQL Server DOS Vulnerability

CVE-2026-67626 Overview

CVE-2026-67626 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Microsoft SQL Server. An authorized attacker can send crafted requests over a network to exhaust server resources and deny service to legitimate users. The flaw requires valid low-privilege credentials but no user interaction, and it targets availability without affecting confidentiality or integrity.

Microsoft published the advisory on October 13, 2026. The vulnerability is rated medium severity due to its authentication requirement and limited impact scope. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
An authenticated attacker can render SQL Server instances unresponsive, disrupting business applications and dependent services that rely on database availability.

Affected Products

Microsoft SQL Server (see vendor advisory for affected build numbers)
Deployments exposing SQL Server endpoints to networks with low-privilege user accounts
Environments without connection rate limiting or resource governance controls

Discovery Timeline

2026-10-13 - CVE-2026-67626 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-67626

Vulnerability Analysis

The vulnerability resides in how SQL Server allocates and manages internal resources when processing certain network requests. An authenticated attacker with low-privilege database access can submit requests that consume disproportionate memory, CPU, or worker threads. Sustained abuse causes the service to become unresponsive to legitimate queries.

This class of flaw is classified under [CWE-400] (Uncontrolled Resource Consumption). The attack targets availability only, with no impact on data confidentiality or integrity. Because the attack vector is network-based with low attack complexity, exploitation does not require advanced tooling.

See the Microsoft Security Update CVE-2026-67626 advisory for build-specific technical details.

Root Cause

The underlying issue is the absence of adequate limits on resource allocation for specific authenticated operations. SQL Server fails to throttle or cap resource usage per session or request type, allowing a single authenticated user to monopolize backend resources.

Attack Vector

Exploitation requires network access to the SQL Server instance and valid credentials for any authenticated account. The attacker establishes one or more sessions and submits crafted operations that trigger unbounded resource allocation. The vulnerability does not require administrative privileges, so compromised application service accounts or low-privilege users can trigger the condition.

No exploitation code example is available. See the Microsoft advisory for technical specifics.

Detection Methods for CVE-2026-67626

Indicators of Compromise

Sudden spikes in SQL Server CPU, memory, or worker-thread utilization without a corresponding increase in legitimate query volume
Repeated connections from a single authenticated principal generating long-running or resource-heavy sessions
SQL Server error logs showing resource pressure messages, timeouts, or exhausted worker thread warnings
Application-tier timeouts and connection pool exhaustion events coinciding with database degradation

Detection Strategies

Baseline normal resource consumption per login and alert on statistical deviations using SQL Server Dynamic Management Views such as sys.dm_exec_sessions and sys.dm_exec_requests
Enable Extended Events sessions to capture high-resource queries and correlate them with originating logins and client hosts
Monitor Performance Monitor counters including Processor Time, Memory Grants Pending, and Processes Blocked for sustained anomalies

Monitoring Recommendations

Forward SQL Server audit logs and Windows event logs to a centralized SIEM for correlation across database and network telemetry
Alert on repeated session establishment from the same principal within short time windows
Track query execution counts per login and flag accounts whose patterns deviate from historical baselines

How to Mitigate CVE-2026-67626

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update CVE-2026-67626 advisory to all affected SQL Server instances
Audit SQL Server logins and remove accounts that no longer require database access
Rotate credentials for application service accounts that connect to SQL Server, especially those with network-exposed endpoints
Restrict network access to SQL Server listeners using firewall rules and limit connectivity to known application subnets

Patch Information

Microsoft has published the security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Security Update CVE-2026-67626 advisory for build-specific patches and apply updates through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

Configure SQL Server Resource Governor to cap CPU, memory, and worker thread consumption per workload group where patching is delayed
Implement connection rate limits and firewall-based access controls to reduce the attack surface for low-privilege accounts
Enforce least-privilege principles on database logins and remove unnecessary permissions from application and service accounts

bash

# Example: Enable Resource Governor and cap a workload group
# Run in SQL Server Management Studio against the master database
ALTER RESOURCE GOVERNOR WITH (CLASSIFIER_FUNCTION = NULL);
ALTER RESOURCE GOVERNOR RECONFIGURE;

CREATE WORKLOAD GROUP limited_group
WITH (
  MAX_DOP = 2,
  REQUEST_MAX_CPU_TIME_SEC = 30,
  REQUEST_MAX_MEMORY_GRANT_PERCENT = 10,
  GROUP_MAX_REQUESTS = 20
);