SQL Injection Vulnerability in Microsoft SQL Server
CVE-2026-118116

7HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2017 (gdr); Microsoft Sql Server 2017 For X64-based Systems (cu31); Microsoft Sql Server 2019 (gdr); Microsoft Sql Server 2019 For X64-based Systems (cu32)
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-118116?

An improper neutralization of special elements in SQL commands in Microsoft SQL Server can be exploited by an authorized attacker to elevate privileges locally. This vulnerability allows attackers to manipulate SQL queries, potentially granting them higher access levels and control over the database environment. Mitigating this risk is essential to protect sensitive data and system integrity.

Affected Version(s)

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2150.2

Microsoft SQL Server 2017 for x64-based Systems (CU31) x64-based Systems 14.0.3006.16 < 14.0.3570.2

Microsoft SQL Server 2019 (GDR) x64-based Systems 15.0.0 < 15.0.2210.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Oct 27, 2026

CVE-2026-118116 Data

JSON