Improper Validation of Specified Type of Input in Microsoft SQL Server - CVE-2026-26115
Published: March 10, 2026
Vulnerability identifier: #VU123758
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26115
CWE-ID: CWE-1287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper validation of specified type of input in SQL Server, which leads to security restrictions bypass and privilege escalation.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-26115
Install updates from vendor's website.
Microsoft SQL Server - addressed in versions 13.0.6480.4, 13.0.7075.5, 14.0.2100.4, 14.0.3520.4, 15.0.2160.4, 15.0.4460.4, 16.0.1170.5, 16.0.4240.4, 17.0.1105.2, 17.0.4020.2