Executive brief
Microsoft SQL Server contains a vulnerability in how it processes untrusted data, allowing a remote attacker to execute arbitrary code on the database server without authorization. This could lead to complete compromise of sensitive business data, operational disruption, or use of the server as a staging point for attacks on other systems. Organizations running SQL Server are exposed to this risk across their network.
Technical details
This vulnerability involves unsafe deserialization of untrusted data within SQL Server, a classic vector for remote code execution. An attacker can send specially crafted network traffic to exploit the deserialization flaw and execute code with the privileges of the SQL Server process. No prior authentication or user interaction is required; the attack is reachable over the network. Successful exploitation results in arbitrary code execution on the server. Microsoft has released security updates to address this issue.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed