CVE-2026-65674: Deserialization RCE in Microsoft SQL Server · ZeroHour

CVE-2026-65674

mass

Deserialization RCE in Microsoft SQL Server

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 16, 2026

AI analysis

CVE-2026-65674 is a deserialization-of-untrusted-data flaw (CWE-502) in Microsoft SQL Server that lets an already authorized attacker run code over the network. It is triggered by sending crafted serialized data that the server deserializes unsafely; no user interaction is required. With low privileges, a successful attack yields high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, network, low complexity, scope unchanged). Any organization running the affected SQL Server builds is in scope, but the advisory data does not name specific versions. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the Microsoft security update that addresses CVE-2026-65674 as soon as it is available for your SQL Server builds, and confirm the patch is installed on every instance. Until then, keep SQL Server off the public internet, restrict network access to trusted hosts, and limit database accounts to least privilege because exploitation requires an authorized (low-privilege) login.

Affected

Microsoft SQL Server

—

Estimated exposure

massMillions of SQL Server deployments overall; vulnerable subset unknown (no version range published) — Microsoft SQL Server is a widely deployed enterprise database; public internet scans have long shown on the order of tens to hundreds of thousands of reachable instances, while total (mostly internal) installations are commonly estimated…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-65674

In the news1 stories

Microsoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 Updates