SQL injection in Microsoft SQL Server - CVE-2026-118118
Published: November 11, 2026
Vulnerability identifier: #VU165026
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118118
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and execute database commands with elevated privileges.
The vulnerability exists due to improper neutralization of special elements used in SQL commands in Microsoft SQL Server when processing attacker-controlled database content during an administrative operation. A remote user can use permission to create or modify database objects to prepare specially crafted content that a separate administrator processes during the affected operation to execute database commands with elevated privileges.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118118
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3