SQL Injection Vulnerability in Microsoft SQL Server
CVE-2026-118114

7.5HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2017 (gdr); Microsoft Sql Server 2017 For X64-based Systems (cu31); Microsoft Sql Server 2019 (gdr); Microsoft Sql Server 2019 For X64-based Systems (cu32)
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-118114?

This vulnerability arises from improper neutralization of special elements used in SQL commands within Microsoft SQL Server. An authorized attacker can exploit this weakness to execute arbitrary SQL queries, potentially allowing them to elevate privileges over a network. This could lead to unauthorized access to sensitive data and critical systems within the SQL Server environment.

Affected Version(s)

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2150.2

Microsoft SQL Server 2017 for x64-based Systems (CU31) x64-based Systems 14.0.3006.16 < 14.0.3570.2

Microsoft SQL Server 2019 (GDR) x64-based Systems 15.0.0 < 15.0.2210.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Oct 27, 2026

CVE-2026-118114 Data

JSON