CVE-2026-54118

Think of SQL Server as the “engine” that runs your company’s databases. This issue lets an attacker who already has an authorized foothold trick SQL Server into running their own code, even from across the network. The result can be anything from silently changing data to taking over the server.

This matters if your business runs Microsoft SQL Server in the affected branches (2016 SP3, 2017, 2019, 2022 GDR, or 2025 CU/GDR builds listed) and you expose SQL Server access to the network. The risk is primarily relevant when an attacker can be “authorized” (the findings describe low authentication requirements and an attacker with some access rather than purely public, anonymous access).

This should be treated as urgent because Microsoft SQL Server can be coerced into executing arbitrary code over the network when an authorized attacker is able to reach the vulnerable behavior. With a security patch available and this marked RED, you should patch quickly rather than waiting for more public exploitation details.