# Microsoft Patches 22 SQL Server Flaws

Published: 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/1b440c3b-e989-5dfb-8474-02f02cbf978e/microsoft-patches-22-sql-server-flaws

> Microsoft fixed 22 SQL Server vulnerabilities enabling DoS, privilege escalation, remote code execution, and data exposure; NCSC-NL urges patching.

NCSC-NL issued an advisory summarizing 22 CVEs patched by Microsoft affecting SQL Server. The vulnerabilities span multiple weakness classes including stack-based and heap-based buffer overflows, out-of-bounds reads, format string issues, integer overflows, use-after-free, insecure deserialization, and uncontrolled resource allocation. Successful exploitation could allow an attacker to cause denial-of-service conditions, escalate privileges, execute arbitrary code with SQL Server service permissions, or access sensitive data.

No evidence of active in-the-wild exploitation is mentioned in the advisory. Microsoft has released updates addressing all listed CVEs, and NCSC-NL recommends organizations apply these patches promptly. Further details, update guidance, and any applicable workarounds are available via the Microsoft Security Response Center portal. This is a standard CERT patch advisory rather than a report on an active campaign.

## Mentioned in this report

- Vulnerabilities: CVE-2026-65674, CVE-2026-67625, CVE-2026-67626, CVE-2026-67628, CVE-2026-68883, CVE-2026-70189, CVE-2026-83945, CVE-2026-85876, CVE-2026-85886, CVE-2026-85888, CVE-2026-85919, CVE-2026-88081, CVE-2026-88082, CVE-2026-88083, CVE-2026-88084, CVE-2026-88085, CVE-2026-88086, CVE-2026-88088, CVE-2026-88089, CVE-2026-94512, CVE-2026-94520, CVE-2026-96956

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0420.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1b440c3b-e989-5dfb-8474-02f02cbf978e/microsoft-patches-22-sql-server-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup