SQL Injection Vulnerability in Microsoft SQL Server
CVE-2026-118119

8HIGH

Key Information:

Vendor: Microsoft
Status: Microsoft Sql Server 2017 (gdr); Microsoft Sql Server 2017 For X64-based Systems (cu31); Microsoft Sql Server 2019 (gdr); Microsoft Sql Server 2019 For X64-based Systems (cu32)
Vendor: CVE Published:; 10 November 2026

What is CVE-2026-118119?

An SQL injection vulnerability exists in Microsoft SQL Server that enables an authorized attacker to manipulate SQL commands. This flaw can allow attackers to escalate their privileges and gain unauthorized access to sensitive data within the database. Proper precautions and patching are recommended to mitigate this risk and secure database environments effectively.

Affected Version(s)

Microsoft SQL Server 2017 (GDR) x64-based Systems 14.0.0 < 14.0.2150.2

Microsoft SQL Server 2017 for x64-based Systems (CU31) x64-based Systems 14.0.3006.16 < 14.0.3570.2

Microsoft SQL Server 2019 (GDR) x64-based Systems 15.0.0 < 15.0.2210.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Oct 27, 2026

CVE-2026-118119 Data

JSON