CVE-2026-54117 Microsoft SQL Server Remote Code Execution Vulnerability

...

CVE-2026-54117

Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...

CVE-2026-42990

CVE-2026-42990 affects the SQL Server ODBC driver, where a heap-based buffer overflow enables code execution over the network. The vulnerability is exploitable remotely (network vector) and is rated high severity (CVSS 3.1: 9.8, CRITICAL) with no privileges required and no user interaction. The a...

CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability

...

CVE-2026-47296 Microsoft SQL Server Elevation of Privilege Vulnerability

...

Microsoft SQL Server Elevation of Privilege Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

Microsoft SQL Server Remote Code Execution Vulnerability

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

SQL Server ODBC driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...

PT-2026-58125

Name of the Vulnerable Software and Affected Versions SQL Server ODBC driver affected versions not specified Description A heap-based buffer overflow in the SQL Server ODBC driver allows an unauthorized remote attacker to execute arbitrary code over a network and achieve elevation of privilege. A...

PT-2026-58246

Name of the Vulnerable Software and Affected Versions SQL Server versions 2016 through 2025 Description An authorized attacker can elevate privileges locally due to external control of a file name or path. This allows an authenticated local user to gain administrative control over the database...

Security Updates for Microsoft SQL Server (July 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over...

KLA91151 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation...

PT-2026-58225

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-55002: External Control of File Name or Path

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-50468: Buffer Over-read

Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-54117: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network...

CVE-2026-42990: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network...

CVE-2026-47296: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-54116: Access of Resource Using Incompatible Type

Access of resource using incompatible type 'type confusion' in SQL Server allows an authorized attacker to disclose information over a network...

CVE-2026-47295: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...