Microsoft SQL Server 2019-2025 Deserialization Bug Allows Auth Users Remote Code Execution

Microsoft SQL Server contains a high-severity remote code execution vulnerability identified as CVE-2026-65674. The flaw stems from the deserialization of untrusted data within the database engine. According to the Microsoft Security Update Guide, this issue allows an authorized attacker to execute arbitrary code over a network. The vulnerability impacts multiple major releases of the software, requiring administrators to verify their specific build versions against the vendor's advisory.

Root cause

The underlying issue is categorized under CWE-502, which denotes the deserialization of untrusted data. This weakness occurs when an application processes serialized objects without sufficiently validating their content or integrity. In the context of SQL Server, the engine processes data streams that can be manipulated by users who already have access to the system. The failure to sanitize these inputs before deserialization creates a pathway for code injection.

Attack path

Exploitation requires the attacker to be an authorized user within the SQL Server environment. This distinction is critical for security teams assessing risk. Unlike unauthenticated flaws, this vector does not allow external actors to breach the perimeter without first obtaining valid credentials. Once inside, the attacker can craft malicious data payloads that trigger the deserialization process. This action results in the execution of arbitrary code on the host system, effectively granting the attacker control over the server.

Affected versions

Microsoft has identified specific builds of SQL Server that remain vulnerable until patched. The affected versions include Microsoft SQL Server 2019 (GDR) before 15.0.2200.2 and SQL Server 2019 for x64-based Systems (CU32) before 15.0.4500.2. Additionally, SQL Server 2022 (GDR) before 16.0.1210.3 and SQL Server 2022 for x64-based Systems (CU27) before 16.0.4305.5 are at risk. The latest release, SQL Server 2025 for x64-based Systems (CU9) before 17.0.5015.4 and GDR before 17.0.1145.4, is also affected.

Mitigation

• Identify all instances of SQL Server 2019, 2022, and 2025 within the network.
• Compare current build numbers against the vulnerable versions listed in the advisory.
• Apply the latest cumulative updates or general distribution releases provided by Microsoft.
• Restrict administrative access to SQL Server instances to reduce the pool of authorized users.

Signals worth monitoring

Security operations teams should focus on detecting anomalous behavior from authenticated accounts. Look for unexpected process creation or new network connections originating from database service accounts. Monitor for unusual data serialization attempts or large, unexplained data transfers within the database logs. Check whether standard database queries are being used to execute system commands. Verify that file integrity monitoring alerts are triggered by changes to system binaries. Review audit logs for any elevation of privilege attempts following successful logins. Ensure that endpoint detection tools are configured to catch suspicious activity from known service accounts.

What to do and how to stay safe: Microsoft SQL Server

• Inventory all SQL Server instances and record their exact version and build numbers.
• Check the Microsoft Security Update Guide to see if your builds are before the fixed versions.
• Plan to install the latest cumulative updates during a maintenance window.
• Review access controls to ensure only necessary users have authorized database access.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability exploitable by unauthenticated attackers?

No, the Microsoft advisory states that an authorized attacker is required to exploit this flaw.

What is the severity rating of CVE-2026-65674?

The National Vulnerability Database rates this vulnerability as HIGH with a CVSS score of 8.8.

Which SQL Server versions are affected?

Versions of SQL Server 2019, 2022, and 2025 prior to the specific cumulative updates listed in the advisory are affected.