CVE-2026-54117 is a critical flaw (CVSS 9.8) in Microsoft SQL Server 2016, 2017, 2019, 2022 and 2025. Deserialization of untrusted data lets an unauthenticated attacker execute code over the network. The record gives no build numbers, so use the Microsoft update guide to find the security update for your version.
What's affected
- Microsoft SQL Server 2016, 2017, 2019, 2022 and 2025, per the record.
- Fixed builds: not stated in the record. The Microsoft Security Response Center entry for the CVE lists the updates per product and servicing branch.
- The sibling record CVE-2026-54118 has the same description and the same product list, so treat the two together.
How to check if you're exposed
Run this on each instance to read the build.
SELECT @@VERSION;
SELECT SERVERPROPERTY('ProductUpdateLevel') AS update_level;
Compare the build with the fixed build in the Microsoft update guide for your servicing branch (GDR or CU). Also list which instances accept connections from outside your database subnet, because the record scores this as network reachable with no authentication.
What to do now
- Open the Microsoft update guide entry for CVE-2026-54117 and note the fixed build for each branch you run.
- Schedule and apply the update, starting with instances reachable from less trusted networks.
- Restrict inbound access to SQL Server ports to the application servers that need them.
- Review the same update for CVE-2026-54118, which affects the same products.
- Record the patched build for each instance.
Why it matters
The class is CWE-502, deserialization of untrusted data. A program that rebuilds objects from bytes it did not create can be driven into running unintended code if the input is hostile. The vector shows no privileges and no user interaction, which is why the score is 9.8.
The record does not mark this CVE as exploited in the wild, and it does not describe the vulnerable component. Do not assume details beyond the advisory. Database servers hold your most valuable data, so a network exposed code execution flaw justifies fast patching.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Which update fixes it?
The record does not name a build. Check the Microsoft update guide page for CVE-2026-54117 and choose the update for your product and branch.
Sources
Last reviewed: 19 October 2026.
