SQL injection in Microsoft SQL Server - CVE-2026-118116
Published: November 11, 2026
Vulnerability identifier: #VU165024
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118116
CWE-ID: CWE-89
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges to SQL sysadmin.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing input used to construct SQL commands. A local user can supply specially crafted input that alters the intended SQL commands to gain SQL sysadmin privileges.
Exploitation requires the vulnerable replication feature and topology to be configured on the affected instance. Access to a participating database or replication peer does not allow this server configuration to be enabled through the vulnerability.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118116
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3