SQL injection in Microsoft SQL Server - CVE-2026-118114
Published: November 11, 2026
Vulnerability identifier: #VU165022
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118114
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to SQL sysadmin.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied input. A remote user can supply crafted input that alters SQL command execution to gain SQL sysadmin privileges.
Exploitation requires the vulnerable replication feature and topology to be configured on the SQL Server instance. Access to a participating database or replication peer does not allow enabling this configuration through the vulnerability.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118114
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3