CVE-2026-65674: SQL Server RCE Vulnerability

CVE-2026-65674 Overview

CVE-2026-65674 is a deserialization of untrusted data vulnerability in Microsoft SQL Server. An authorized attacker with network access can send crafted serialized objects to execute arbitrary code on the database server. The flaw is classified under [CWE-502] Deserialization of Untrusted Data.

Microsoft published the advisory on October 13, 2026. Successful exploitation grants code execution in the context of the SQL Server process, which commonly runs with elevated privileges on the host. The attack vector is network-based and requires low privileges but no user interaction.

Critical Impact

An authenticated attacker on the network can execute arbitrary code against SQL Server, compromising confidentiality, integrity, and availability of hosted databases.

Affected Products

• Microsoft SQL Server (refer to the Microsoft Security Update Guide for specific affected builds)

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-65674 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-65674

Vulnerability Analysis

The vulnerability resides in how SQL Server processes serialized object data submitted over the network. When the server deserializes attacker-controlled input without sufficient type validation, it instantiates objects whose constructors or callbacks trigger arbitrary code paths. This behavior aligns with the [CWE-502] weakness pattern.

Exploitation requires an authenticated database session, as reflected by the low-privilege requirement. Once authenticated, the attacker submits a crafted payload through a code path that performs unsafe deserialization. The resulting code executes within the SQL Server service account context.

Impact extends beyond the database. Code execution on the SQL Server host enables credential theft, lateral movement, data exfiltration, and manipulation of stored data. Attackers can chain this flaw with privilege escalation on the host to compromise the broader environment.

Root Cause

The root cause is unsafe deserialization of untrusted input. SQL Server reconstructs .NET or binary objects from attacker-supplied data without enforcing a strict type allowlist. Gadget chains available in the loaded assemblies allow the deserializer to execute code during object graph construction.

Attack Vector

The attack originates from the network and targets authenticated database sessions. An attacker with valid credentials sends a malicious serialized payload through a vulnerable SQL Server interface. The server deserializes the payload and executes the embedded gadget chain, producing remote code execution. See the Microsoft Security Update Guide for protocol-level details.

Detection Methods for CVE-2026-65674

Indicators of Compromise

• Unexpected child processes spawned by sqlservr.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
• Outbound network connections initiated by the SQL Server service to untrusted hosts.
• SQL Server error log entries referencing deserialization exceptions or CLR assembly load failures.
• New or modified assemblies registered through CREATE ASSEMBLY statements from low-privilege accounts.

Detection Strategies

• Monitor process ancestry for anomalous children of sqlservr.exe across endpoint telemetry.
• Inspect SQL Server audit logs for unusual stored procedure calls, CLR integration events, and large binary parameters from standard application accounts.
• Correlate authentication events with subsequent command execution originating from the database host.

Monitoring Recommendations

• Enable SQL Server Extended Events auditing for CLR execution and failed deserialization events.
• Forward Windows Security and Sysmon logs from database hosts to a centralized SIEM for behavioral analysis.
• Alert on new logins from service accounts that normally do not authenticate interactively to SQL Server.

How to Mitigate CVE-2026-65674

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-65674.
• Inventory all SQL Server instances, including development and legacy deployments, to confirm patch coverage.
• Rotate credentials for SQL Server service accounts and application logins after patching.

Patch Information

Microsoft released a security update addressing CVE-2026-65674. Administrators should consult the Microsoft Security Update Guide to identify the applicable cumulative update or GDR package for each SQL Server version in the environment.

Workarounds

• Restrict network access to SQL Server endpoints using firewall rules and network segmentation so that only authorized application hosts can reach port 1433 and related services.
• Enforce least-privilege database roles and remove unused permissions from application accounts to limit the authenticated attack surface.
• Disable CLR integration (sp_configure 'clr enabled', 0) where not required to reduce available deserialization gadget chains.
• Enable SQL Server auditing and review logs for anomalous queries from accounts with database access.

# Configuration example
# Disable CLR integration if not required by applications
sqlcmd -S <server> -Q "EXEC sp_configure 'clr enabled', 0; RECONFIGURE;"

# Restrict inbound SQL Server access to known application hosts
New-NetFirewallRule -DisplayName "Restrict SQL 1433" -Direction Inbound \
  -Protocol TCP -LocalPort 1433 -RemoteAddress <app-subnet> -Action Allow