CVE-2026-65674

Summary

SQL Server allows authenticated attackers to execute arbitrary code by deserializing untrusted data, creating a high-severity remote code execution vulnerability that can be exploited over the network.

Exploitability

Exploitation requires an authenticated user account with access to SQL Server, making it moderately difficult but still highly impactful, as attackers need only establish a valid session to leverage this deserialization flaw.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the SQL Server, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the latest available security patch from Microsoft for SQL Server 2019 and SQL Server 2022, specifically targeting the deserialization vulnerability in the SQL Server engine.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.