CVE-2026-54117

This vulnerability is a security flaw in Microsoft SQL Server that can let a trusted attacker—someone who already has authorization—send specially crafted network data and cause the SQL Server to run code it shouldn’t. Think of it like giving someone with a key access to your “back room” where they can’t usually start the machines, but the flaw lets them switch it into “arbitrary control.”

This matters if your business runs Microsoft SQL Server 2025 (including the CU 6 and the GDR x64-based release). The issue is reachable over the network and does not require you (or a user) to click anything. The risk is mainly for situations where an attacker already has authorization and can reach the vulnerable SQL Server remotely.

This should be treated as urgent because it is a remote code execution flaw, meaning an authorized attacker can run arbitrary code from across the network. Even though there’s no clear dated public exploitation report in the findings, the impact is high and a patch is available for the affected SQL Server 2025 versions.

1. Confirm the exact SQL Server version/build

   • On the SQL Server machine, check the installed product/version and the build number for Microsoft SQL Server 2025.
   • Determine whether you are on the Microsoft SQL Server 2025 (CU 6) track or the Microsoft SQL Server 2025 for x64-based Systems (GDR) track.

2. Compare against the fixed versions

   • If you are on Microsoft SQL Server 2025 (CU 6), confirm whether you are running a build earlier than 17.0.4060.2.
   • If you are on Microsoft SQL Server 2025 for x64-based Systems (GDR), confirm whether you are running a build earlier than 17.0.1125.2.

3. Upgrade to the correct fixed version

   • Upgrade Microsoft SQL Server 2025 (CU 6) to 17.0.4060.2.
   • Upgrade Microsoft SQL Server 2025 for x64-based Systems (GDR) to 17.0.1125.2.
   • After the update, restart SQL Server as required by your standard patch process, then re-check that the build/version matches the fixed version.

4. If patching is delayed (temporary containment)

   • Restrict network access to SQL Server so that only required hosts/users can reach it (because the flaw is network-triggered).
   • Reduce who has “authorization” to SQL Server (e.g., ensure only necessary accounts have access), since the findings indicate authorization is required for exploitation.
   • Monitor for unusual login attempts and unexpected sessions from remote addresses.

5. What to monitor after updating

   • Authentication/logon activity to SQL Server (unexpected accounts, odd login times, repeated failures).
   • SQL Server service health and any abnormal spikes in activity after the patch window.

6. CISA KEV status

   • This CVE is not listed in the CISA KEV findings provided, so there is no KEV-driven confirmation here; however, patching is still required because the vulnerability class and available fixes are clear.

CVE-2026-54117 is rated HIGH (CVSS 8.8). The core weakness is CWE-502: unsafe deserialization of untrusted data. The findings state that an authorized attacker can execute arbitrary code on a vulnerable Microsoft SQL Server remotely, with no user interaction, using network access to trigger the unsafe deserialization path. KEV is not listed for this CVE in the provided findings, and there is no clear dated exploitation claim in the news findings; additionally, no public exploit code is present in the provided material. Patch availability is confirmed for Microsoft SQL Server 2025 (CU 6) fixed in 17.0.4060.2 and Microsoft SQL Server 2025 for x64-based Systems (GDR) fixed in 17.0.1125.2.