Microsoft SQL Server CVE-2026-47297

The CVSS PR:N metric indicates authentication is not required prior to exploitation. The AC:H metric indicates a specific, non-default condition or timing requirement must be met - precise details are not disclosed in the available description or references, which is typical of Microsoft pre-exploitation disclosures. Exploitation is limited to network-reachable SQL Server instances (default port 1433/TCP). Instances fully isolated behind firewalls or restricted to trusted application hosts are substantially harder to reach. SQL Server 2019, 2022, and 2025 are all affected on x64 platforms across both GDR and CU servicing branches, so no particular feature or non-default configuration is described as required beyond network reachability. The specific AC:H precondition is not independently verifiable from available public data - consult the MSRC advisory for any clarifying technical detail.

CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H represents a significant severity. The PR:N metric indicates no authentication is required, which elevates concern for internet-facing SQL Server instances; however, the AC:H metric critically limits exploitability - a specific attack condition must be satisfied that is not trivially repeatable. No EPSS data is provided in this input; no KEV listing exists; no public proof-of-concept has been identified. The real-world risk is meaningful for any SQL Server instance reachable over a network (port 1433/TCP), but the AC:H constraint narrows the practical attacker pool to skilled adversaries. All three actively-supported SQL Server major versions are affected, maximizing exposure breadth. Organizations with SQL Server instances exposed to untrusted networks (or the internet) should treat this as a priority patch given the potential for full C:H/I:H/A:H impact upon successful exploitation.

An unauthenticated remote attacker sends a specially crafted network payload to the SQL Server TDS listener (port 1433/TCP) during a connection or protocol negotiation phase that triggers deserialization. By constructing a malicious serialized object using an available .NET or SQL-layer gadget chain, the attacker causes the SQL Server process to execute arbitrary code. Successful exploitation yields code execution in the context of the SQL Server service account, typically with broad local system or network privileges. No public exploit code has been confirmed at time of analysis.