CVE-2026-47297

HIGH 8.1CVE-2026-47297 · Published 08/09/2026 · updated 02/10/2026

In short

CVE-2026-47297 is a HIGH (CVSS 8.1) vulnerability affecting sql server 2019 (microsoft), sql server 2022 (microsoft), sql server 2025 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.0% of all vulnerabilities.
Fix: update to 15.0.4490.9, 15.0.2190.7, 16.0.4275.2, 16.0.1200.5 or later.

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2026-47297 is a HIGH (CVSS 8.1) vulnerability affecting sql server 2019 (microsoft), sql server 2022 (microsoft), sql server 2025 (microsoft).

Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.0% of all vulnerabilities.

Fix: update to 15.0.4490.9, 15.0.2190.7, 16.0.4275.2, 16.0.1200.5 or later.

Package

Affected versions

Patched versions

≥ 15.0.4003.23, < 15.0.4490.9< 15.0.2190.7

15.0.4490.915.0.2190.7

≥ 16.0.4003.1, < 16.0.4275.2< 16.0.1200.5

16.0.4275.216.0.1200.5

≥ 17.0.4006.2, < 17.0.4085.5< 17.0.1135.8

17.0.4085.517.0.1135.8

More vulnerabilities in sql server 2019

See all →