CVE-2026-65674
8.8HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated attackers with network access can execute arbitrary code on the underlying host. They need valid low-privileged credentials on the target SQL Server instance first.
Root cause
Insecure deserialization of untrusted user input within SQL Server allows arbitrary object instantiation and code execution.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the Microsoft security update from the MSRC advisory for your specific SQL Server version. If patching must wait, restrict network access to the SQL Server port (default TCP 1433) using firewall rules to trusted client IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.