{"id":"CVE-2026-116929","kind":"vulnerability","aliases":["CVE-2026-116929"],"related":[],"title":"Microsoft SQL Server: authorized user can gain higher privileges over network","description":"Execution with unnecessary privileges in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"CWE-250: SQL Server runs a component with more privileges than it needs. An attacker with a low-privilege account can raise their privileges over the network. Attack complexity is high. Microsoft rates it 7.5 and the exploit code maturity as unproven. Fixed in the November 10, 2026 security updates.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"SQL Server 2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"SQL Server 2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","privilege-escalation","self-hosted","sql-server","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT @@VERSION (or SELECT SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 GDR 14.0.2150.2, 2017 CU31 branch 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 branch 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 branch 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 branch 17.0.5045.3. Anything below your branch's build is affected.","fix":"Install the November 10, 2026 SQL Server security update for your branch. For 2022 CU27 that is KB5129300, build 16.0.4315.2. Other builds are listed in how-to-check. Microsoft says to enable encryption with Extended Protection on Windows.","status":"open","published_at":"2026-11-10T19:19:22+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:44:52+00:00","updated_at":"2026-11-10T23:36:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T19:44:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: authorized user can gain higher privileges over network","impact":"high","summary":"SQL Server runs some code with more privileges than it needs. An attacker who already holds a valid account can use this to elevate their privileges over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with a valid login gains elevated database server privileges","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116929 for affected versions, fixed builds and any workaround.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server where attackers can log in with a valid account. The sources do not list affected versions or configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":4490,"output_tokens":377,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116929 for affected versions, fixed builds and any workaround.","search":"'-116929':14A,17A '-2026':13A,16A '-250':42B '10':88B '2017':20A '2019':23A '2022':26A '2025':29A '2026':89B '7.5':76B 'account':61B 'allow':99C 'attack':55B,69B,102C 'author':4A,101C 'code':80B 'complex':70B 'compon':47B 'cve':12A,15A 'cwe':41B 'elev':104C 'escal':33B 'execut':92C 'exploit':79B 'fix':84B 'gain':7A 'high':72B 'higher':8A 'host':36B 'low':59B 'low-privileg':58B 'matur':81B 'microsoft':1A,30B,73B 'need':53B 'network':11A,68B,108C 'novemb':87B 'privileg':9A,32B,50B,60B,65B,95C,105C 'privilege-escal':31B 'rais':63B 'rate':74B 'run':45B 'secur':90B 'self':35B 'self-host':34B 'server':3A,19A,22A,25A,28A,39B,44B,98C 'sql':2A,18A,21A,24A,27A,38B,43B,97C 'sql-server':37B 'unnecessari':94C 'unproven':83B 'updat':91B 'user':5A 'vendor':40B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where attackers can log in with a valid account. The sources do not list affected versions or configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2017","server2019","server2022","server2025","sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","microsoft","privilegeescalation","selfhosted","sqlserver","vendor"],"campaign_type":null,"search_a":"'-116929':14A,17A '-2026':13A,16A '2017':20A '2019':23A '2022':26A '2025':29A 'author':4A 'cve':12A,15A 'gain':7A 'higher':8A 'microsoft':1A 'network':11A 'privileg':9A 'server':3A,19A,22A,25A,28A 'sql':2A,18A,21A,24A,27A 'user':5A","search_b":"'-250':42B '10':88B '2026':89B '7.5':76B 'account':61B 'attack':55B,69B 'code':80B 'complex':70B 'compon':47B 'cwe':41B 'escal':33B 'exploit':79B 'fix':84B 'high':72B 'host':36B 'low':59B 'low-privileg':58B 'matur':81B 'microsoft':30B,73B 'need':53B 'network':68B 'novemb':87B 'privileg':32B,50B,60B,65B 'privilege-escal':31B 'rais':63B 'rate':74B 'run':45B 'secur':90B 'self':35B 'self-host':34B 'server':39B,44B 'sql':38B,43B 'sql-server':37B 'unproven':83B 'updat':91B 'vendor':40B","search_c":"'allow':99C 'attack':102C 'author':101C 'elev':104C 'execut':92C 'network':108C 'privileg':95C,105C 'server':98C 'sql':97C 'unnecessari':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116929","severity":null,"published_at":"2026-11-10T19:19:22+00:00","modified_at":"2026-11-10T19:19:22+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116929:3199","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:36:35+00:00","modified_at":"2026-11-10T23:36:35+00:00","first_seen_at":"2026-11-10T23:36:35+00:00","fetched_at":"2026-11-10T23:36:35+00:00","note":"MSRC page is JS-only and unreadable here. Fix build for SQL 2022 CU27 (16.0.4315.2) confirmed on Microsoft KB5129300; other branches' builds come from the CNA data via OpenCVE, so nothing is marked verified. No exploitation or PoC reported (CVSS 7.5, E:U).","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116929"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120388,"url":"https://app.opencve.io/cve/CVE-2026-116929","title":"OpenCVE record for CVE-2026-116929 (mirrors Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}