Code Injection in Microsoft SQL Server - CVE-2026-118112
Published: November 11, 2026
Vulnerability identifier: #VU165020
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118112
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper control of code generation in Microsoft SQL Server when an administrative operation processes specially crafted database content. A remote user can create or modify database objects containing this content and have it processed when a separate administrator performs the affected operation to execute database commands with elevated privileges.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118112
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3