CVE-2026-54117

CriticalCVSS 9.8/10Last modified Aug 20, 2026

Description

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Aug 20, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-541189.8Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-541197.5Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a neCVE-2026-54126.5In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the ClouCVE-2026-541208.8Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.CVE-2026-541218.8Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.CVE-2026-541228.4Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.CVE-2026-541235.5Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose infoCVE-2026-541247.8Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.CVE-2026-541257.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attackerCVE-2026-541266.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-541278.4Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.CVE-2026-541288.4Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.
CVE-2026-54117: Critical severity, CVSS 9.8 | Vulnix