Microsoft Patches 62 SQL Server Vulnerabilities

NCSC-NL advisory details 62 Microsoft SQL Server and Windows OLE DB flaws, many enabling remote code execution or privilege escalation; patches available, no active exploitation reported.

NCSC-NL (Dutch national CERT) published an advisory summarizing 62 vulnerabilities that Microsoft has patched across SQL Server components and the Windows OLE DB provider used by SQL Server. The flaw classes include SQL injection, stack- and heap-based buffer overflows, use-after-free, deserialization of untrusted data, integer overflow/underflow, out-of-bounds read, untrusted pointer dereference, weak authentication, and insufficient access-control granularity. Impact categories span arbitrary code execution, privilege escalation, security-control bypass, sensitive information disclosure, and denial-of-service. Many of the higher-severity issues (CVSS 8.5-8.8) allow remote code execution or elevation of privilege, indicating an attacker with database access or the ability to submit crafted queries/input could potentially gain code execution or higher privileges on the SQL Server host.

No indication is given in the advisory of active exploitation in the wild; this is a routine vendor patch release consolidated into a single NCSC bulletin. Defenders running Microsoft SQL Server (all supported versions per Microsoft's Security Update Guide) and systems relying on Windows OLE DB should prioritize testing and deploying the referenced Microsoft updates, particularly for instances exposed to untrusted networks or multi-tenant environments where SQL injection or privilege-escalation vectors could be reached by lower-privileged users. Full technical details, affected product/version matrices, and update packages are available via the Microsoft Security Response Center portal linked in the advisory.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0350.html