Deserialization Vulnerability in Microsoft SQL Server
CVE-2026-54118

8.8HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2016 Service Pack 3 (gdr); Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack; Microsoft Sql Server 2017 (cu 31); Microsoft Sql Server 2017 (gdr)
Vendor: CVE Published:; 14 July 2026

What is CVE-2026-54118?

A deserialization vulnerability in Microsoft SQL Server could allow an authorized attacker to execute arbitrary code over a network. This occurs when untrusted data is processed, leading to a risk of remote code execution. Organizations using affected versions of SQL Server should prioritize applying patches to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6500.1

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7095.1

Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3540.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 14, 2026
Vulnerability Reserved
Jun 11, 2026

CVE-2026-54118 Data

JSON