External risk intelligence

SQL Server Remote Code Execution via Untrusted Data Deserialization.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-54117

The vulnerability affects SQL Server, a database management system. While network-reachable in some environments, SQL Server is designed to operate as a back-end service within internal networks, protected by firewalls and other access controls. Direct, public internet exposure of database ports is considered a poor security practice and is not a common or intended deployment pattern.

Deserialization

Microsoft Sql Server 2016

13.0.6300.2 to before 13.0.6500.113.0.7000.253 to before 13.0.7095.114.0.1000.169 to before 14.0.2120.114.0.3006.16 to before 14.0.3540.115.0.2000.5 to before 15.0.2180.215.0.4003.23 to b...

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in Microsoft SQL Server that could allow an unauthorized attacker to execute code remotely. This vulnerability stems from how the software handles untrusted data, presenting a significant risk if exploited. The main concern is confirming relevance and exposure within our environments.

Untrusted data allows remote code execution.
Database security is critical for operations.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable SQL Server instance. This could allow them to execute arbitrary code with the privileges of the SQL Server process.

Unauthenticated network access required.
Triggered by deserializing untrusted data.
Enables unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Deserialization of untrusted data in SQL Server could allow an unauthorized attacker to execute code over a network. This could affect system data and service behavior when exposed externally and not properly secured.

System data could be compromised.
Network code execution may occur.
Unauthorized access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in SQL Server requires immediate attention from teams responsible for database administration and application development. The first practical step is to inventory all SQL Server instances, confirm their network exposure and criticality, and identify the specific application or service owners. Subsequently, a risk-based remediation plan, prioritizing critical and exposed systems, should be developed and executed, potentially involving vendor coordination and planned maintenance.

Database administrators and application owners.
Verify SQL Server network exposure and criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Microsoft SQL Server and why is it used?

Microsoft SQL Server is a relational database management system. Organizations use it to store, manage, and retrieve data for a wide variety of business applications, ranging from small internal tools to large-scale enterprise services. It acts as a central repository where data is processed and shared across networks, making it a critical component of infrastructure that underpins many software platforms.

What does deserialization of untrusted data mean for CVE-2026-54117?

This vulnerability is classified as CWE-502, which occurs when an application takes data from an untrusted source and reconstructs it into an object without sufficient validation. In the context of CVE-2026-54117, if an attacker provides specially crafted input to the SQL Server, the process of deserializing that data can be manipulated to trigger the execution of unauthorized, arbitrary code on the host system.

How is this vulnerability triggered by an attacker?

An attacker triggers this bug by sending maliciously formed data to a vulnerable SQL Server instance over the network. Crucially, this does not require legitimate user credentials or authenticated access to the database to initiate the exploitation process. However, the flaw is not triggered by standard, authorized database queries or normal operational data traffic; it requires specifically crafted input designed to abuse the deserialization process.

Why should I be concerned about my SQL Server's network placement?

Halo Surface Signal notes that while SQL Server is often hosted internally, any instance with direct, public internet exposure faces a significantly higher risk from this vulnerability. Because the exploit can occur over a network without authentication, systems reachable from the internet are prime targets. Even if your database is internal, understanding its network footprint is essential to assessing the potential impact of an unauthorized party gaining a foothold in your environment.

What steps should I take if I manage SQL Server instances?

Begin by creating a comprehensive inventory of all SQL Server instances across your organization to identify which versions are in use. Verify the network configuration for each instance to determine if it is exposed externally. Once mapped, identify the owners of these databases and coordinate with them to prioritize high-risk, internet-facing systems for security updates and vendor-provided patches as part of your maintenance lifecycle.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.