CVE-2026-67368: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft Microsoft SQL Server 2017 (CU 31)

CVE-2026-67368 is a vulnerability classified under CWE-59 (Improper Link Resolution Before File Access) in Microsoft SQL Server 2017 (CU 31) and related versions. The issue arises from the software incorrectly resolving symbolic links before accessing files, which can be exploited by an authorized attacker to elevate privileges remotely over a network. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix addressing this vulnerability. No known exploits are reported in the wild at this time.

An authorized attacker can leverage this vulnerability to elevate privileges on the affected SQL Server instances remotely over a network. The impact includes potential full compromise of confidentiality, integrity, and availability of the affected system. This could allow attackers to execute unauthorized actions with elevated permissions.

An official fix is available from Microsoft. Users should apply the security updates provided by Microsoft for the affected versions of SQL Server as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-67368. No additional mitigation steps are indicated by the vendor advisory.