SQL injection in Microsoft SQL Server - CVE-2026-118120
Published: November 11, 2026
Vulnerability identifier: #VU165029
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118120
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges and execute database commands beyond the intended replication functionality.
The vulnerability exists due to improper neutralization of special elements in SQL commands in the SQL Server replication functionality when processing requests from users with permission to synchronize a database subscription. A remote user can send a specially crafted request to execute database commands beyond the intended replication functionality and escalate privileges.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-118120
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3