CVE-2026-54118

Think of SQL Server as the “engine” that runs your company’s databases. This issue lets an attacker who already has an authorized foothold trick SQL Server into running their own code, even from across the network. The result can be anything from silently changing data to taking over the server.

This matters if your business runs Microsoft SQL Server in the affected branches (2016 SP3, 2017, 2019, 2022 GDR, or 2025 CU/GDR builds listed) and you expose SQL Server access to the network. The risk is primarily relevant when an attacker can be “authorized” (the findings describe low authentication requirements and an attacker with some access rather than purely public, anonymous access).

This should be treated as urgent because Microsoft SQL Server can be coerced into executing arbitrary code over the network when an authorized attacker is able to reach the vulnerable behavior. With a security patch available and this marked RED, you should patch quickly rather than waiting for more public exploitation details.

1. Confirm exposure to the vulnerability

   • Determine the exact SQL Server version and build (for example, 2016 SP3 GDR vs Azure Connect Feature Pack; 2017 CU 31 vs GDR; 2019 CU 32 vs GDR; 2022 GDR; 2025 CU 6 vs GDR).
   • Record the current build number so you can compare it to Microsoft’s fixed builds.

2. Check whether you’re on a fixed or vulnerable build

   • If you are in one of the affected branches, ensure your build is at or above the fixed build corresponding to your branch.
   • Fixed builds from Microsoft for CVE-2026-54118:
     • Microsoft SQL Server 2016 Service Pack 3 (GDR) → 13.0.6500.1
     • Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack → 13.0.7095.1
     • Microsoft SQL Server 2017 (CU 31) → 14.0.3540.1
     • Microsoft SQL Server 2017 (GDR) → 14.0.2120.1
     • Microsoft SQL Server 2019 (CU 32) → 15.0.4480.2
     • Microsoft SQL Server 2019 (GDR) → 15.0.2180.2
     • Microsoft SQL Server 2022 (GDR) → 16.0.1190.2
     • Microsoft SQL Server 2022 for x64-based Systems (CU 25) → 16.0.4262.2
     • Microsoft SQL Server 2025 (CU 6) → 17.0.4060.2
     • Microsoft SQL Server 2025 for x64-based Systems (GDR) → 17.0.1125.2

3. Upgrade/patch

   • Apply the Microsoft security update from the MSRC update guide for CVE-2026-54118.
   • Plan a maintenance window if your environment requires service restarts.

4. Validate after patching

   • Re-check the SQL Server build number to confirm it matches the fixed build for your branch.
   • Confirm services come back healthy and application connectivity is normal.

5. Temporary risk reduction while patching (if you cannot patch immediately)

   • Reduce the chance of an attacker gaining “authorized” access by tightening who can authenticate to SQL Server (review database/server logins, remove unused accounts, enforce least privilege).
   • Limit network access to SQL Server (restrict inbound connections to only the required IPs/hosts). The findings indicate the attack uses the network, so reducing network reachability helps.

6. What to monitor

   • Monitor SQL Server logs for unusual authentication attempts and unexpected database or server activity around the timeframe you suspect exposure.

7. Timetable note

   • No CISA KEV entry was listed in the provided findings, and there is no clear dated press exploitation claim; however, the presence of a patch and the RED verdict mean you should act as if the window for exploitation risk is real.

CVE-2026-54118 is a remote code execution issue in Microsoft SQL Server (CWE-502) involving unsafe deserialization of untrusted data. The findings state that an authorized attacker can execute arbitrary code remotely over the network with no user interaction required and low authentication requirements; the exact default-reachability conditions are not specified in the findings.

Mitigation is straightforward in principle: upgrade to the fixed builds listed by Microsoft. In the provided findings, there is no CISA KEV listing, no clear dated real-world exploitation claim, and no public exploit code on record; nevertheless, the vulnerability is still treated as RED due to the ability to achieve arbitrary code execution remotely once the attacker has an authorized foothold.

CVE-2026-54118 patch reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54118.