SQL injection in Microsoft SQL Server - CVE-2026-118113
Published: November 11, 2026
Vulnerability identifier: #VU165021
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118113
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when an administrator performs an affected administrative operation that processes attacker-controlled database content. A remote user can prepare specially crafted content using permission to create or modify database objects to execute database commands with elevated privileges when a separate administrator performs that operation.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118113
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3