VDB
CVE-2026-118116
CVE-2026-118116
PUBLISHED
CVSS 7 HIGH
Microsoft SQL Server Elevation of Privilege Vulnerability
Reported by microsoft · Published November 10, 2026
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
Risk scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft SQL Server 2017 (GDR) | 14.0.0 |
| Microsoft | Microsoft SQL Server 2017 for x64-based Systems (CU31) | 14.0.3006.16 |
| Microsoft | Microsoft SQL Server 2019 (GDR) | 15.0.0 |
| Microsoft | Microsoft SQL Server 2019 for x64-based Systems (CU32) | 15.0.4003.23 |
| Microsoft | Microsoft SQL Server 2022 (GDR) | 16.0.0 |
| Microsoft | Microsoft SQL Server 2022 for x64-based Systems (CU27) | 16.0.4003.1 |
| Microsoft | Microsoft SQL Server 2025 CU10 | 17.0.4006.0 |
| Microsoft | Microsoft SQL Server 2025 for x64-based Systems (GDR) | 17.0.1050.2 |
| microsoft | sql_server_2025 | 17.0.1050.2 |
| Microsoft | Microsoft SQL Server 2022 for x64-based Systems (CU27) | 16.0.4003.1 |
| Microsoft | Microsoft SQL Server 2017 (GDR) | 14.0.0 |
| Microsoft | Microsoft SQL Server 2017 for x64-based Systems (CU31) | 14.0.3006.16 |
| microsoft | sql_server_2019 | 15.0.0 |
| microsoft | sql_server_2022 | 16.0.0 |
| Microsoft | Microsoft SQL Server 2019 (GDR) | 15.0.0 |
| microsoft | microsoft_sql_server_2017_for_x64-based_systems_\(cu31\) | 14.0.3006.16 |
| Microsoft | Microsoft SQL Server 2022 (GDR) | 16.0.0 |
| microsoft | microsoft_sql_server_2022_for_x64-based_systems_\(cu27\) | 16.0.4003.1 |
| microsoft | sql_server_2017 | 14.0.0 |
| Microsoft | Microsoft SQL Server 2025 CU10 | 17.0.4006.0 |
…and 4 more
Timeline
- Nov 10, 2026 CVE Published
- Nov 11, 2026 EPSS Score
- Nov 11, 2026 Coalition ESS Score
- Nov 11, 2026 CVE Updated
- Nov 12, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-118116
vulnetix vdb fixes CVE-2026-118116Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-118116/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Microsoft SQL Server Elevation of Privilege Vulnerability vendor-advisorypatch