HighVulnerability

CVE-2026-65674

Authenticated Remote Code Execution in Microsoft SQL Server via Untrusted Deserialization

Published Oct 13, 2026 · Updated 3 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

20 mentions · peak 15 in a dayToday

CVSS8.8High · v3.1

EPSS1.6%76th percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendor: Microsoft Corporation

IdentifiersCVE-2026-65674CWE-502 · Deserialization of Untrusted Data

CVE-2026-65674 is an untrusted-data deserialization vulnerability in Microsoft SQL Server affecting SQL Server 2017, 2019, 2022, and 2025. An authenticated attacker with low privileges can submit a specially crafted network request or query to execute arbitrary code on an affected server without user interaction. The precise vulnerable function is not identified. Microsoft rates the vulnerability Important, with a CVSS v3.1 score of 8.8 and vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits remote arbitrary code execution on the affected SQL Server system, with potentially high impacts on confidentiality, integrity, and availability. This could enable unauthorized access to or modification of data and disruption of database services. The resulting execution privileges are not specified.

Mitigation

If you can’t patch tonight, do this now.

No vulnerability-specific interim workaround is documented. Install the applicable SQL Server security update.

Remediation

Patch, then assume compromise.

Install the applicable October 13, 2026 security update for the installed SQL Server version and servicing branch: SQL Server 2025 CU9+GDR—KB5126967, build 17.0.5015.4; SQL Server 2025 RTM+GDR—KB5128492, build 17.0.1145.4; SQL Server 2022 CU27+GDR1—KB5126934, build 16.0.4305.5; SQL Server 2022 RTM+GDR—KB5128493, build 16.0.1210.3; SQL Server 2019 CU32+GDR—KB5128494, build 15.0.4500.2; SQL Server 2019 RTM+GDR—KB5128495, build 15.0.2200.2; SQL Server 2017 CU31+GDR—KB5128496, build 14.0.3560.2; SQL Server 2017 RTM+GDR—KB5128497, build 14.0.2140.2. Verify update prerequisites and applicability to the installed servicing branch before deployment.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationMicrosoft Sql Server 2019 For X64-Based Systems (Cu32)application

Microsoft CorporationMicrosoft Sql Server 2022 For X64-Based Systems (Cu27)application

Microsoft CorporationMicrosoft Sql Server 2025 For X64-Based Systems (Cu9)application

Microsoft CorporationSql Serverapplication

Microsoft CorporationSql Server 2019application

Microsoft CorporationSql Server 2022application

Microsoft CorporationSql Server 2025application

External references

References

MITRE CVEcve.org · CVE-2026-65674 NVDnvd.nist.gov/vuln/detail/CVE-2026-65674 MITRE CWE · CWE-502Deserialization of Untrusted Data msrc.microsoft.commsrc.microsoft.com/update-guide/vulnerability/CVE-2026-65674

Activity feed

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

security affairsNews · Oct 14, 2026Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 UpdatesA Microsoft SQL Server remote code execution vulnerability caused by deserialization of untrusted data. An authorized attacker with the required privileges can exploit it over a network to execute code on the affected server. The article identifies it as a high-priority threat with a CVSS score of 8.8.Read more ↗tenable nessus pluginsNews · Oct 14, 2026Security Updates for Microsoft SQL Server (October 2026) | Tenable®An untrusted-data deserialization vulnerability in Microsoft SQL Server that allows an authorized attacker to execute code over a network. The plugin attributes its CVSS v3 base score of 8.8 to this vulnerability.Read more ↗tenable nessus pluginsNews · Oct 14, 2026Security Updates for Microsoft SQL Server (October 2026) | Tenable®Microsoft SQL Server untrusted-data deserialization vulnerability allowing an authorized attacker to execute code over a network. The plugin attributes a CVSS v3 score of 8.8 to this CVE. Detection relies on the application's self-reported version rather than exploitation testing.Read more ↗ghsa syntheticNews · Oct 13, 2026GHSA-qgrc-x7f5-246vAn untrusted-data deserialization vulnerability in SQL Server that allows an authorized attacker to execute code over a network.Read more ↗

+13 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity2Community discussion across Reddit, Mastodon, and other social sources.

HighVulnerability

CVE-2026-65674

Authenticated Remote Code Execution in Microsoft SQL Server via Untrusted Deserialization

Published Oct 13, 2026 · Updated 3 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

20 mentions · peak 15 in a dayToday

CVSS8.8High · v3.1

EPSS1.6%76th percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendor: Microsoft Corporation

IdentifiersCVE-2026-65674CWE-502 · Deserialization of Untrusted Data

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Mitigation

If you can’t patch tonight, do this now.

No vulnerability-specific interim workaround is documented. Install the applicable SQL Server security update.

Remediation

Patch, then assume compromise.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationMicrosoft Sql Server 2019 For X64-Based Systems (Cu32)application

Microsoft CorporationMicrosoft Sql Server 2022 For X64-Based Systems (Cu27)application

Microsoft CorporationMicrosoft Sql Server 2025 For X64-Based Systems (Cu9)application

Microsoft CorporationSql Serverapplication

Microsoft CorporationSql Server 2019application

Microsoft CorporationSql Server 2022application

Microsoft CorporationSql Server 2025application

External references

References

Activity feed

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+13 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity2Community discussion across Reddit, Mastodon, and other social sources.