SQL Server Elevation of Privilege Vulnerability in Microsoft Products
CVE-2026-118115

7.5HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2017 (gdr); Microsoft Sql Server 2017 For X64-based Systems (cu31); Microsoft Sql Server 2022 (gdr); Microsoft Sql Server 2022 For X64-based Systems (cu27)
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-118115?

The vulnerability in Microsoft SQL Server arises from improper neutralization of special elements within SQL commands. This flaw enables an authorized attacker to execute elevated privileges over a network, potentially compromising the integrity and confidentiality of the database. Organizations using vulnerable versions of SQL Server must apply recommended patches to safeguard against exploitation.

Affected Version(s)

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2150.2

Microsoft SQL Server 2017 for x64-based Systems (CU31) x64-based Systems 14.0.3006.16 < 14.0.3570.2

Microsoft SQL Server 2022 (GDR) x64-based Systems 16.0.0 < 16.0.1220.3

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Oct 27, 2026

CVE-2026-118115 Data

JSON