Microsoft Patches 22 SQL Server Flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft fixed 22 SQL Server vulnerabilities enabling DoS, privilege escalation, remote code execution, and data exposure; NCSC-NL urges patching.
NCSC-NL issued an advisory summarizing 22 CVEs patched by Microsoft affecting SQL Server. The vulnerabilities span multiple weakness classes including stack-based and heap-based buffer overflows, out-of-bounds reads, format string issues, integer overflows, use-after-free, insecure deserialization, and uncontrolled resource allocation. Successful exploitation could allow an attacker to cause denial-of-service conditions, escalate privileges, execute arbitrary code with SQL Server service permissions, or access sensitive data.
No evidence of active in-the-wild exploitation is mentioned in the advisory. Microsoft has released updates addressing all listed CVEs, and NCSC-NL recommends organizations apply these patches promptly. Further details, update guidance, and any applicable workarounds are available via the Microsoft Security Response Center portal. This is a standard CERT patch advisory rather than a report on an active campaign.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0420.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs