Microsoft Patches 62 SQL Server Vulnerabilities
NCSC-NL advisory details 62 Microsoft SQL Server and Windows OLE DB flaws, many enabling remote code execution or privilege escalation; patches available, no active exploitation reported.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL (Dutch national CERT) published an advisory summarizing 62 vulnerabilities that Microsoft has patched across SQL Server components and the Windows OLE DB provider used by SQL Server. The flaw classes include SQL injection, stack- and heap-based buffer overflows, use-after-free, deserialization of untrusted data, integer overflow/underflow, out-of-bounds read, untrusted pointer dereference, weak authentication, and insufficient access-control granularity. Impact categories span arbitrary code execution, privilege escalation, security-control bypass, sensitive information disclosure, and denial-of-service. Many of the higher-severity issues (CVSS 8.5-8.8) allow remote code execution or elevation of privilege, indicating an attacker with database access or the ability to submit crafted queries/input could potentially gain code execution or higher privileges on the SQL Server host.
No indication is given in the advisory of active exploitation in the wild; this is a routine vendor patch release consolidated into a single NCSC bulletin. Defenders running Microsoft SQL Server (all supported versions per Microsoft's Security Update Guide) and systems relying on Windows OLE DB should prioritize testing and deploying the referenced Microsoft updates, particularly for instances exposed to untrusted networks or multi-tenant environments where SQL injection or privilege-escalation vectors could be reached by lower-privileged users. Full technical details, affected product/version matrices, and update packages are available via the Microsoft Security Response Center portal linked in the advisory.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0350.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,566 reports from 147 sources, 722 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs