Microsoft SQL Server: Remote Code Execution via deserialization

Summary

Microsoft SQL Server contains a deserialization flaw (CWE-502) that allows an authorized attacker to execute code over the network. The attacker needs a valid login, but no action from a user is required, and the impact on confidentiality, integrity and availability is rated high. Microsoft has released fixes for the affected builds, and CISA's SSVC assessment rates exploitation as none, but risk remains for internet-facing or privileged instances.

Affected

• SQL Server 2019 (GDR): 15.0.0 to before 15.0.2200.2
• SQL Server 2019 x64 (CU32): 15.0.4003.23 to before 15.0.4500.2
• SQL Server 2022 (GDR): 16.0.0 to before 16.0.1210.3
• SQL Server 2022 x64 (CU27): 16.0.4003.1 to before 16.0.4305.5
• SQL Server 2025 x64 (CU9): 17.0.4006.2 to before 17.0.5015.4
• SQL Server 2025 x64 (GDR): 17.0.1050.2 to before 17.0.1145.4 (Microsoft's table starts at 17.0.1000.7, to be verified)
• SQL Server 2017: included in Microsoft's table, not in the CVE record; treat as in scope until MSRC confirms

Fixed in

• SQL Server 2025 CU9+GDR: 17.0.5015.4 (update 5126967)
• SQL Server 2025 RTM+GDR: 17.0.1145.4 (update 5128492)
• SQL Server 2022 CU27+GDR1: 16.0.4305.5 (KB5126934)
• SQL Server 2022 RTM+GDR: 16.0.1210.3 (update 5128493)
• SQL Server 2019 CU32+GDR: 15.0.4500.2 (update 5128494)
• SQL Server 2019 RTM+GDR: 15.0.2200.2 (update 5128495)
• SQL Server 2017 CU31+GDR: 14.0.3560.2 (update 5128496)
• SQL Server 2017 RTM+GDR: 14.0.2140.2 (update 5128497)

Workaround

• No vendor-documented workaround is available.
• Until patched, restrict which hosts can reach SQL Server ports, run the service with a least-privilege account, and review logins and recent activity on instances that were reachable from the internet.

Exploitation

• No evidence of exploitation in the wild found as of 31 Oct 2026; the CISA KEV alert of 23 Oct 2026 lists a different CVE.
• No public proof-of-concept known; Tenable reports no known exploits.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the October 2026 security update for each SQL Server version and branch in use.
• Identify all SQL Server instances and check first those that are internet-facing or run under privileged service accounts.
• Restrict network access to SQL Server ports and enforce strong, unique credentials.
• Review logins and activity logs on exposed instances for signs of misuse.
• Monitor vendor and CISA advisories for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-65674 msrc.microsoft.com
• Microsoft KB5126934: SQL Server 2022 CU27 GDR, October 2026 support.microsoft.com
• Tenable plugin 365626 www.tenable.com
• Tenable plugin 365627 www.tenable.com
• CISA KEV alert, 23 Oct 2026 www.cisa.gov
• Dark Reading: Microsoft October 2026 Patch Tuesday www.darkreading.com
• Senserva KB 5126934 senserva.com
• Offseq threat radar: CVE-2026-65674 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:08.