CVE-2026-54118 is a critical flaw (CVSS 9.8) in Microsoft SQL Server 2016, 2017, 2019, 2022 and 2025. Deserialization of untrusted data lets an unauthenticated attacker execute code over the network. The record names no fixed build, so take the update from the Microsoft update guide for your version.
What's affected
- Microsoft SQL Server 2016, 2017, 2019, 2022 and 2025, per the record.
- Fixed builds: not stated in the record. The Microsoft Security Response Center entry lists updates per product and servicing branch.
- CVE-2026-54117 has an identical description and product list. Check both entries when you plan the update.
How to check if you're exposed
Read the build on each instance.
SELECT @@VERSION;
Match it against the fixed build in the Microsoft update guide for CVE-2026-54118. Then list instances that can be reached from outside the database subnet. The record scores the flaw as network exploitable without authentication or user interaction.
What to do now
- Open the Microsoft update guide entry for CVE-2026-54118 and find the update for each branch you run.
- Apply the update, beginning with instances that are reachable from less trusted networks.
- Limit inbound access to SQL Server to the hosts that need it.
- Check the entry for CVE-2026-54117 as well.
- Write down the patched build per instance.
Why it matters
The class is CWE-502, deserialization of untrusted data. Rebuilding objects from attacker supplied bytes can lead to code running that the developer never intended. The vector has no privilege requirement and no user interaction, hence the 9.8 score.
The record does not mark this CVE as exploited in the wild and gives no detail on the vulnerable component, so avoid guessing. Two CVEs with the same text often mean two separate code paths with the same flaw type, so patching one entry without the other is not enough.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is one update enough for both CVEs?
Do not assume that. Check the Microsoft update guide for each CVE and confirm the build you install lists both.
Sources
Last reviewed: 19 October 2026.
