Elevation of Privilege Vulnerability in Microsoft SQL Server
CVE-2026-26115

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Sql Server 2016 Service Pack 3 (gdr)
Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack
Microsoft Sql Server 2017 (cu 31)
Microsoft Sql Server 2017 (gdr)
Vendor
CVE Published:
10 March 2026

What is CVE-2026-26115?

An improper validation vulnerability exists in Microsoft SQL Server that could allow an attacker with valid credentials to exploit the system. By sending specially crafted input over the network, an attacker could potentially escalate their privileges, gaining unauthorized access to sensitive data and the ability to perform administrative tasks. This highlights the importance of securing SQL Server environments and applying necessary updates to mitigate the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Microsoft SQL Server 2016 Service Pack 3 (GDR) x64-based Systems 13.0.0 < 13.0.6480.4

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack x64-based Systems 13.0.0 < 13.0.7075.5

Microsoft SQL Server 2017 (CU 31) x64-based Systems 14.0.0 < 14.0.3520.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.