CVE-2026-32650 is a vulnerability in Anviz CrossChex Standard that arises from improper handling of the TDS7 PreLogin handshake, enabling an attacker to disable encryption. This results in database credentials being sent unencrypted over the network, exposing them to interception and unauthorized database access. The issue is classified under CWE-757 (Improper Neutralization of Special Elements used in a Command). All versions of the product are affected. The CVSS 3.1 base score is 7.5, reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability allows an attacker to intercept database credentials in plaintext due to disabled encryption during the PreLogin phase. This can lead to unauthorized access to the database, compromising sensitive data confidentiality. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider network-level protections such as encrypting traffic via VPN or restricting network access to the database server. Monitor vendor communications for updates on patches or official mitigations.