Microsoft warns that authorized attackers can run remote code on SQL Server versions 2019 through 2025 via a high-severity deserialization flaw.
Key points
- CVE-2026-65674 allows remote code execution by authorized users on multiple SQL Server versions.
- The National Vulnerability Database rates the flaw as high severity with a CVSS score of 8.8.
- Affected versions include SQL Server 2019, 2022, and 2025 prior to specific cumulative update builds.
Microsoft has identified a remote code execution vulnerability in its SQL Server database software. The flaw affects versions 2019, 2022, and 2025 and allows attackers with valid credentials to execute arbitrary code over a network.
What happened
Microsoft Security Update Guide lists CVE-2026-65674 as a high-severity issue in SQL Server. The vulnerability stems from the deserialization of untrusted data within the database engine. An attacker who possesses authorized access to the server can exploit this flaw to run code remotely. This capability gives the attacker control over the affected system.
The National Vulnerability Database assigns a CVSS score of 8.8 to this defect. This score places the weakness in the high severity category. The issue is linked to CWE-502, which describes improper deserialization of untrusted data. Microsoft confirms the flaw exists in several recent releases of its database product.
Affected systems include Microsoft SQL Server 2019 General Distribution Release builds before 15.0.2200.2. SQL Server 2019 for x64-based systems is vulnerable in Cumulative Update 32 builds before 15.0.4500.2. SQL Server 2022 GDR builds before 16.0.1210.3 are also at risk.
SQL Server 2022 for x64-based systems faces exposure in CU27 builds before 16.0.4305.5. SQL Server 2025 for x64-based systems is vulnerable in CU9 builds before 17.0.5015.4. The 2025 version is also affected in GDR builds before 17.0.1145.4. No other versions are listed as impacted in the advisory.
Why it matters
Deserialization involves converting data streams back into objects. When systems process untrusted data without validation, attackers can inject malicious payloads. This often leads to remote code execution. Teams usually restrict database access to minimize exposure. Check whether your organization audits privileged accounts regularly. Limiting who can connect to the database reduces the attack surface.
The fix
- Apply the latest cumulative updates for SQL Server 2019, 2022, and 2025.
- Verify that your build numbers meet or exceed the safe versions listed in the advisory.
- Review access logs for any unauthorized attempts to connect to the database.
- Ensure that all database administrators use strong, unique credentials.
Why it matters
Database servers often hold sensitive information and run with high privileges. A remote code execution flaw allows attackers to bypass application logic. This can lead to full system compromise. Organizations should monitor for unusual database activity. Regular audits of user permissions help prevent abuse. Security teams must prioritize patching critical infrastructure components.
What to do and how to stay safe: Microsoft
- Check your current SQL Server version against the affected build numbers.
- Install the latest cumulative updates provided by Microsoft for your version.
- Review database access logs for any suspicious connections from authorized accounts.
- Restrict database access to only those users who require it for their role.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SQL Server versions are affected by CVE-2026-65674?
Versions 2019, 2022, and 2025 are affected if they are below the specified cumulative update or general distribution release builds.
What is the severity of this vulnerability?
The National Vulnerability Database rates CVE-2026-65674 as high severity with a CVSS score of 8.8.
Can unauthenticated attackers exploit this flaw?
No, the advisory states that an authorized attacker is required to exploit this deserialization vulnerability.
