PT-2026-58224 · Microsoft · Sql Server 2025

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-54117

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SQL Server 2025 versions prior to 17.0.4060.2

Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object, which can be exploited if the input is not properly validated.

Recommendations Update SQL Server 2025 to version 17.0.4060.2.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-54117

Affected Products

Sql Server 2025

References · 3

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54117 · Security Note
• https://twitter.com/windowsforum/status/2077175102173544747 · Twitter Post