Origin validation error in Microsoft SQL Server - CVE-2026-118111
Published: November 11, 2026
Vulnerability identifier: #VU165019
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118111
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and run database commands with elevated privileges.
The vulnerability exists due to an origin validation error in SQL Server when an administrator performs an administrative operation that processes attacker-controlled database content. A remote user can use permissions to create or modify database objects to prepare specially crafted content that, when processed by a separate administrator, allows database commands to run with elevated privileges.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118111
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3