CVE-2026-67386

Awaiting Analysis Awaiting Analysis - Queue

Use of Uninitialized Resource in SQL Server Discloses Information

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-67386

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	sql_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of an uninitialized resource in SQL Server. An authorized attacker can exploit this to disclose information over a network. It requires network access and low privileges but can lead to significant data exposure.

Impact Analysis

An attacker could access sensitive data stored in the SQL Server database without proper authorization. This may result in data breaches, loss of confidential information, or unauthorized access to personal or business data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data disclosure. Organizations may face legal penalties, fines, or reputational damage for failing to protect sensitive data.

Mitigation Strategies

Apply the latest security updates from Microsoft for SQL Server immediately to address the uninitialized resource issue. Ensure all systems are patched and monitor for unusual network activity or unauthorized data access.

Hi! I’m here to help you understand CVE-2026-67386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70