Improper Authorization in Microsoft SQL Server - CVE-2026-118108
Published: November 11, 2026
Vulnerability identifier: #VU165016
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118108
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and run SQL code with elevated privileges.
The vulnerability exists due to improper authorization in Microsoft SQL Server when handling database operations over a network. A remote user can exploit insufficient authorization checks through access to a participating database or replication peer to run SQL code with elevated privileges.
Exploitation requires the SQL Server instance to have the vulnerable replication feature and topology configured. This configuration cannot be enabled through the vulnerability.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118108
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3