What happened
A new high-severity vulnerability has been identified in Microsoft SQL Server versions 2019, 2022, and 2025. The flaw, designated CVE-2026-65674, involves the deserialization of untrusted data within the SQL Server environment. Exploitation of this weakness can allow an authorised attacker to execute arbitrary code over a network. The vulnerability is classified as high impact, with an CVSS score of 8.8, owing to the potential for remote code execution.
The exploited pathway involves sending specially crafted serialized data to an exposed SQL Server service. If network exposure is present and the relevant service is accessible, an attacker with low-privileged account permissions can successfully execute this attack without requiring any user interaction. The process relies purely on network access, underscoring the importance of network segregation and access controls to mitigate risks.
Vendor advisories currently do not specify a patched version or available fix. Affected software includes specific builds of Microsoft SQL Server 2019, 2022, and 2025, with version ranges detailed in vendor communications. This indicates that affected deployments may be vulnerable if they are running listed versions without additional protective measures.
Who is affected
Organisations running Microsoft SQL Server 2019 (GDR and CU32 updates), SQL Server 2022 (GDR and CU27 updates), or SQL Server 2025 (CU9 and GDR updates) versions listed within the specified ranges are affected by this vulnerability. Any instance where these versions are accessible via networks could potentially be exploited, emphasizing the importance of network security and segmentation for affected deployments.
Recommended actions
Review network exposure of SQL Server instances to prevent direct access from untrusted networks or unauthorised entities.
Implement strict access controls and network segmentation to limit the ability of low-privileged accounts to reach the exposed services in question.
Monitor for unusual activity or indicators of compromise related to the affected services, especially those consistent with remote code execution attempts.
