Executive brief
Microsoft SQL Server, a widely used database management system, contains a security vulnerability that could allow an authorized user to take control of the server. By sending specially crafted data to the database, an attacker with basic login credentials can execute malicious commands. This could lead to the theft of sensitive data, disruption of business operations, or a complete compromise of the database environment.
Technical details
A deserialization vulnerability (CWE-502) exists in Microsoft SQL Server 2025. The flaw is rooted in the way the server processes untrusted data during deserialization operations, which can be manipulated to trigger arbitrary code execution. An attacker must be authenticated to the network and have basic permissions (Low Privileges) to reach the vulnerable component. Successful exploitation allows for remote code execution (RCE) in the context of the SQL Server service account, potentially leading to full system compromise. Microsoft has released security updates to address this issue.
Affected products
- Microsoft SQL Server 2025 (CU 6) 17.0.4060.2
- Microsoft SQL Server 2025 for x64-based Systems (GDR) 17.0.1050.2 to 17.0.1125.2
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory