CVE-2026-47297

CVE-2026-47297 is a deserialization flaw (CWE-502) in Microsoft SQL Server in which untrusted serialized input is processed without adequate validation, allowing an unauthenticated, network-located attacker to execute arbitrary code. It is triggered by sending crafted serialized data to the SQL Server service, with no privileges or user interaction required, although the high attack complexity (AC:H) suggests specific conditions must be met for exploitation to succeed. Successful exploitation carries high impact across confidentiality, integrity, and availability, meaning attackers gain arbitrary code execution on the database host. Any deployment of affected Microsoft SQL Server builds is potentially affected, especially instances reachable from untrusted networks; the available data does not specify which versions are impacted. There is currently no evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.8% probability of exploitation in the next 30 days (56th percentile).

What to do: Check Microsoft's MSRC advisory for CVE-2026-47297 to identify which SQL Server versions in your environment are affected and apply the security update it specifies as soon as possible. In the interim, restrict exposure of SQL Server (TCP 1433/1434) to trusted networks and remove any unnecessary public reachability. Inventory exposed instances using external scan data and prioritize patching internet-facing database servers first.