CVE-2026-54117

Microsoft SQL Server is vulnerable to a deserialization-of-untrusted-data flaw (CWE-502) allowing an unauthorized network attacker to execute arbitrary code with no authentication required (CVSS 9.8 critical). Affected products include SQL Server 2016 through 2025, Fabric Data Warehouse, and Powe...

CVE-2026-54118

Microsoft SQL Server (2019, 2022, 2025) is vulnerable to deserialization of untrusted data leading to remote code execution (CVSS 9.8, no authentication required). No in-the-wild exploitation is reported (SSVC: Exploitation none). Microsoft released July 14, 2026 patches: KB5101346 (SQL 2025 CU6)...

CVE-2026-67378

CVE-2026-67378 is an untrusted pointer dereference in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 9.0 (Critical) with a high attack complexity, no required privileges, and a changed scope (impact: high across con...

CVE-2026-67636

CVE-2026-67636 is an out-of-bounds read vulnerability in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The CNA-assigned CVSS 3.1 score is 9.0 (CRITICAL) , with a network attack vector, high complexity, no required privileges, changed sc...

CVE-2026-67643

CVE-2026-67643 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. Microsoft assigned a CVSS 3.1 score of 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA's SSVC assessment rates exp...

CVE-2026-67631

CVE-2026-67631 is a heap-based buffer overflow in Microsoft SQL Server that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability is rated CVSS 3.1 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating no privileges or user in...