CVE-2026-54117

Microsoft SQL Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 74th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile74th1.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-08-20Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Microsoft SQL Server is Microsoft SQL Server 2025 (CU 6) or Microsoft SQL Server 2025 for x64-based Systems (GDR).
If you are on Microsoft SQL Server 2025 (CU 6), upgrade to fixed version 17.0.4060.2.
If you are on Microsoft SQL Server 2025 for x64-based Systems (GDR), upgrade to fixed version 17.0.1125.2.
After upgrading, verify the server reports the new build/version and review remote-access and login activity for unusual behavior.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-54117 is a remote code execution bug in Microsoft SQL Server that lets an authorized attacker run code over the network; you should worry and patch if you run the affected SQL Server 2025 versions.

CVE-2026-54117 is an unsafe deserialization weakness in Microsoft SQL Server 2025 that enables an authorized attacker to trigger remote code execution over the network (no user interaction).

If you're affected

Full database compromise
Malware installation on server
Service disruption
Data theft or tampering

What is it

This vulnerability is a security flaw in Microsoft SQL Server that can let a trusted attacker—someone who already has authorization—send specially crafted network data and cause the SQL Server to run code it shouldn’t. Think of it like giving someone with a key access to your “back room” where they can’t usually start the machines, but the flaw lets them switch it into “arbitrary control.”

Who is affected

This matters if your business runs Microsoft SQL Server 2025 (including the CU 6 and the GDR x64-based release). The issue is reachable over the network and does not require you (or a user) to click anything. The risk is mainly for situations where an attacker already has authorization and can reach the vulnerable SQL Server remotely.

How urgent is it

This should be treated as urgent because it is a remote code execution flaw, meaning an authorized attacker can run arbitrary code from across the network. Even though there’s no clear dated public exploitation report in the findings, the impact is high and a patch is available for the affected SQL Server 2025 versions.

What to do — in detail

Confirm the exact SQL Server version/build
- On the SQL Server machine, check the installed product/version and the build number for Microsoft SQL Server 2025.
- Determine whether you are on the Microsoft SQL Server 2025 (CU 6) track or the Microsoft SQL Server 2025 for x64-based Systems (GDR) track.
Compare against the fixed versions
- If you are on Microsoft SQL Server 2025 (CU 6), confirm whether you are running a build earlier than 17.0.4060.2.
- If you are on Microsoft SQL Server 2025 for x64-based Systems (GDR), confirm whether you are running a build earlier than 17.0.1125.2.
Upgrade to the correct fixed version
- Upgrade Microsoft SQL Server 2025 (CU 6) to 17.0.4060.2.
- Upgrade Microsoft SQL Server 2025 for x64-based Systems (GDR) to 17.0.1125.2.
- After the update, restart SQL Server as required by your standard patch process, then re-check that the build/version matches the fixed version.
If patching is delayed (temporary containment)
- Restrict network access to SQL Server so that only required hosts/users can reach it (because the flaw is network-triggered).
- Reduce who has “authorization” to SQL Server (e.g., ensure only necessary accounts have access), since the findings indicate authorization is required for exploitation.
- Monitor for unusual login attempts and unexpected sessions from remote addresses.
What to monitor after updating
- Authentication/logon activity to SQL Server (unexpected accounts, odd login times, repeated failures).
- SQL Server service health and any abnormal spikes in activity after the patch window.
CISA KEV status
- This CVE is not listed in the CISA KEV findings provided, so there is no KEV-driven confirmation here; however, patching is still required because the vulnerability class and available fixes are clear.

Technical context

CVE-2026-54117 is rated HIGH (CVSS 8.8). The core weakness is CWE-502: unsafe deserialization of untrusted data. The findings state that an authorized attacker can execute arbitrary code on a vulnerable Microsoft SQL Server remotely, with no user interaction, using network access to trigger the unsafe deserialization path. KEV is not listed for this CVE in the provided findings, and there is no clear dated exploitation claim in the news findings; additionally, no public exploit code is present in the provided material. Patch availability is confirmed for Microsoft SQL Server 2025 (CU 6) fixed in 17.0.4060.2 and Microsoft SQL Server 2025 for x64-based Systems (GDR) fixed in 17.0.1125.2.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS74th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.5% chance of exploitation activity in the next 30 days, which ranks it in the 74th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 37 days, from the signal feeds we watch.

2026-08-20Patch availablerecord updated
2026-07-22Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- sql server 2016DatabaseOn-premDatabases / relational
- sql server 2017On-premOperating Systems / windows
- sql server 2019DatabaseOn-premDatabases / relational
- sql server 2022DatabaseOn-premDatabases / relational
- sql server 2025On-premOperating Systems / windows
- Microsoft SQL Server 2025 (CU 6)On-premOperating Systems / windows
- Microsoft SQL Server 2025 for x64-based Systems (GDR)DatabaseOn-premDatabases / relational

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable