Exposed dangerous method or function in Microsoft SQL Server - CVE-2026-84010
Published: November 11, 2026
Vulnerability identifier: #VU165540
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84010
CWE-ID: CWE-749
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges to SQL sysadmin privileges.
The vulnerability exists due to exposure of a dangerous method or function in Microsoft SQL Server when handling requests over a network. A remote user can invoke the exposed functionality to gain SQL sysadmin privileges.
Only SQL Server instances configured as replication distributors are affected.
Affected software
Microsoft SQL Server
How to mitigate CVE-2026-84010
Install security update from vendor's website.
Microsoft SQL Server - addressed in versions 14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3, 16.0.4315.2, 17.0.1155.3, 17.0.5045.3