Review reviewHigh

CVE-2026-54118

Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31)

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.29%

Technical severityCVSS 8.8

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Product: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31)
Affected versions: >= 13.0.0 < 13.0.6500.1, >= 13.0.0 < 13.0.7095.1, >= 14.0.0 < 14.0.3540.1, >= 14.0.0 < 14.0.2120.1, >= 15.0.0.0 < 15.0.4480.2, >= 15.0.0 < 15.0.2180.2, >= 16.0.0 < 16.0.1190.2, >= 16.0.4260.1 < 16.0.4262.2, >= 17.0.4060.2 < 17.0.4060.2, >= 17.0.1050.2 < 17.0.1125.2, >= 13.0.6300.2 < 13.0.6500.1, >= 13.0.7000.253 < 13.0.7095.1, >= 14.0.1000.169 < 14.0.2120.1, >= 14.0.3006.16 < 14.0.3540.1, >= 15.0.2000.5 < 15.0.2180.2, >= 15.0.4003.23 < 15.0.4480.2, >= 16.0.1000.6 < 16.0.1190.2, >= 16.0.4003.1 < 16.0.4262.2, >= 17.0.1000.7 < 17.0.1125.2, >= 17.0.4006.2 < 17.0.4060.2
Fixed versions: 13.0.6500.1, 13.0.7095.1, 14.0.2120.1, 14.0.3540.1, 15.0.2180.2, 15.0.4480.2, 16.0.1190.2, 16.0.4262.2, 17.0.1125.2, 17.0.4060.2

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.