CVE-2026-65674

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2019 (affected versions not specified) Microsoft SQL Server 2022 (affected versions not specified) Microsoft SQL Server 2025 (affected versions not specified)

Description An authenticated attacker with low privileges can execute arbitrary code over the network due to the deserialization of untrusted data. Deserialization is the process of converting a data stream back into an object, which, when handled insecurely, can lead to remote code execution.

Recommendations Apply Microsoft security updates for the correct release and servicing branch of SQL Server 2019. Apply Microsoft security updates for the correct release and servicing branch of SQL Server 2022. Apply Microsoft security updates for the correct release and servicing branch of SQL Server 2025. Restrict unnecessary database exposure and review account permissions.