{"id":"CVE-2026-116930","kind":"vulnerability","aliases":["CVE-2026-116930"],"related":[],"title":"Microsoft SQL Server: command injection allows remote code execution (CVSS 8.8, patched Nov 2026)","description":"Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.","summary":"Command injection (CWE-77) in SQL Server lets an unauthorized attacker execute code over the network. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R). Microsoft fixed it in the November 10, 2026 security updates for SQL Server 2017, 2019, 2022 and 2025. No exploitation reported as of Nov 10.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"SQL Server 2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"SQL Server 2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","other","self-hosted","sql-server","windows"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT SERVERPROPERTY('ProductVersion'), SERVERPROPERTY('ProductLevel'); compare to the fixed builds. Builds below the fixed build for your branch (GDR or CU) are affected.","fix":"Install the November 2026 SQL Server security update: 2017 GDR 14.0.2150.2 / CU31 14.0.3570.2; 2019 GDR 15.0.2210.4 / CU32 15.0.4510.2; 2022 GDR 16.0.1220.3 / CU27 16.0.4315.2 (KB5129300); 2025 GDR 17.0.1155.3 / CU10 17.0.5045.3. Microsoft also advises enabling encryption with Extended Protection on Windows.","status":"open","published_at":"2026-11-10T19:19:22+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:30:26+00:00","updated_at":"2026-11-10T23:36:19+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:30:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: command injection lets an attacker run code over network","impact":"high","summary":"SQL Server does not properly neutralize special characters in a command, so a flaw lets an unauthorized attacker execute code over the network. The NVD entry gives a CVSS score of 8.8 and lists no affected product ranges or fixed versions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sql-server","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the database server over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116930 for affected versions, patches and any setting that changes exposure.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server are the likely exposure; the sources do not list affected versions or configurations. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":4492,"output_tokens":399,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-116930 for affected versions, patches and any setting that changes exposure.","search":"'-116930':17A,20A '-2026':16A,19A '-77':45B '10':71B,89B '2017':23A,78B '2019':26A,79B '2022':29A,80B '2025':32A,82B '2026':14A,72B '8.8':11A,59B 'allow':6A,104C 'attack':52B,107C 'av':60B 'code':8A,54B,110C 'command':4A,42B,98C,99C 'cve':15A,18A 'cvss':10A,58B 'cwe':44B 'element':94C 'execut':9A,53B,109C 'exploit':84B 'fix':66B 'host':37B 'improp':90C 'inject':5A,43B,100C 'l/pr':62B 'let':49B 'linux':33B 'microsoft':1A,65B 'n/ac':61B 'n/ui':63B 'network':57B,113C 'neutral':91C 'nov':13A,88B 'novemb':70B 'patch':12A 'r':64B 'remot':7A 'report':85B 'secur':73B 'self':36B 'self-host':35B 'server':3A,22A,25A,28A,31A,40B,48B,77B,103C 'special':93C 'sql':2A,21A,24A,27A,30A,39B,47B,76B,102C 'sql-server':38B 'unauthor':51B,106C 'updat':74B 'use':95C 'window':41B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server are the likely exposure; the sources do not list affected versions or configurations. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2017","server2019","server2022","server2025","sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","linux","other","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-116930':17A,20A '-2026':16A,19A '2017':23A '2019':26A '2022':29A '2025':32A '2026':14A '8.8':11A 'allow':6A 'code':8A 'command':4A 'cve':15A,18A 'cvss':10A 'execut':9A 'inject':5A 'microsoft':1A 'nov':13A 'patch':12A 'remot':7A 'server':3A,22A,25A,28A,31A 'sql':2A,21A,24A,27A,30A","search_b":"'-77':45B '10':71B,89B '2017':78B '2019':79B '2022':80B '2025':82B '2026':72B '8.8':59B 'attack':52B 'av':60B 'code':54B 'command':42B 'cvss':58B 'cwe':44B 'execut':53B 'exploit':84B 'fix':66B 'host':37B 'inject':43B 'l/pr':62B 'let':49B 'linux':33B 'microsoft':65B 'n/ac':61B 'n/ui':63B 'network':57B 'nov':88B 'novemb':70B 'r':64B 'report':85B 'secur':73B 'self':36B 'self-host':35B 'server':40B,48B,77B 'sql':39B,47B,76B 'sql-server':38B 'unauthor':51B 'updat':74B 'window':41B","search_c":"'allow':104C 'attack':107C 'code':110C 'command':98C,99C 'element':94C 'execut':109C 'improp':90C 'inject':100C 'network':113C 'neutral':91C 'server':103C 'special':93C 'sql':102C 'unauthor':106C 'use':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116930","severity":null,"published_at":"2026-11-10T19:19:22+00:00","modified_at":"2026-11-10T19:19:23+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116930:3198","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:36:19+00:00","modified_at":"2026-11-10T23:36:19+00:00","first_seen_at":"2026-11-10T23:36:19+00:00","fetched_at":"2026-11-10T23:36:19+00:00","note":"MSRC page is JS-only (unreadable). Fix build for 2022 CU27 read on Microsoft KB5129300 (lists this CVE); other builds from CNA data via OpenCVE, not primary-read. No exploitation/PoC found; not in KEV.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116930"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120384,"url":"https://app.opencve.io/cve/CVE-2026-116930","title":"OpenCVE: CVE-2026-116930 (CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}