SQL injection in Microsoft SQL Server - CVE-2026-118115
Published: November 11, 2026
Vulnerability identifier: #VU165023
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118115
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to SQL sysadmin in Microsoft SQL Server.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing user-supplied input. A remote user can supply crafted input over the network to alter SQL commands and gain SQL sysadmin privileges.
Exploitation requires the affected SQL Server instance to have the vulnerable replication feature and topology configured. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118115
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3