EUVD-2026-44032
GHSA-c2qv-v7mm-7vwh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity deserialization RCE, but Microsoft's 'authorized attacker' wording implies a valid login is needed, so PR:L rather than PR:N; total impact gives C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) arises from unsafe deserialization of untrusted data (CWE-502), letting an attacker who can reach the database over the network run arbitrary code in the SQL Server process context. Microsoft rates it critical (CVSS 9.8) and has shipped fixes across all supported branches; there is no public exploit identified at time of analysis and CISA SSVC lists exploitation as none. EPSS is modest at 1.29% (67th percentile), consistent with a serious-but-not-yet-exploited server-side flaw.
Technical ContextAI
The root cause is CWE-502, deserialization of untrusted data: SQL Server reconstructs objects from an attacker-influenced serialized stream without sufficiently validating type or content, allowing a malicious payload to drive code execution during the deserialization gadget chain. The affected component spans the core Database Engine across GDR and CU servicing trains, per the CPE data covering microsoft_sql_server_2016_service_pack_3 (GDR and Azure Connect Feature Pack), 2017 (GDR/CU31), 2019 (GDR/CU32), 2022 (GDR/CU25), and 2025 (GDR/CU6). Deserialization flaws in .NET-based server products are a recurring RCE class because a single reachable sink processing crafted binary/structured input can yield full process compromise.
RemediationAI
Apply the Microsoft-released security updates for your servicing train: upgrade GDR installs to at least 13.0.6500.1 (2016 SP3), 14.0.2120.1 (2017), 15.0.2180.2 (2019), 16.0.1190.2 (2022), or 17.0.1125.2 (2025), and CU installs to 13.0.7095.1 (2016 Azure Connect FP), 14.0.3540.1 (2017 CU31), 15.0.4480.2 (2019 CU32), 16.0.4262.2 (2022 CU25), or the 2025 CU6 build, following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54118. Because Microsoft did not document a supported configuration-based workaround, if you cannot patch immediately reduce exposure by restricting network reachability of the SQL Server TDS port (default TCP 1433 and any named-instance/UDP 1434 browser ports) to trusted application hosts via firewall/NSG rules and removing any direct internet exposure - accepting that this breaks direct client connectivity from untrusted networks - and enforce least-privilege database logins so fewer principals can reach the vulnerable code path, noting this only narrows, not eliminates, risk from authenticated actors.
Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted S
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege
SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privile
Privilege escalation via external file path control in Microsoft SQL Server affects versions 2016 through 2025, exploita
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
SQL injection in Microsoft SQL Server 2016-2025 allows authenticated high-privilege attackers to elevate privileges loca
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today