{"id":"CVE-2026-116934","kind":"vulnerability","aliases":["CVE-2026-116934"],"related":[],"title":"Microsoft SQL Server: authorized user can escalate privileges over network","description":"Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Untrusted pointer dereference (CWE-822) in SQL Server lets an authenticated low-privileged user escalate privileges over the network (CVSS 8.8). Microsoft fixed it in the November 10, 2026 security updates; no exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2017-cu31","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"sql-server-2019-gdr","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"sql-server-2019-cu32","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"sql-server-2022-gdr","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"sql-server-2022-cu27","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"sql-server-2025-gdr","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"},{"name":"sql-server-2025-cu10","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","other","self-hosted","sql-server"],"not_affected_if":[],"how_to_check":"Run SELECT @@VERSION (or SELECT SERVERPROPERTY('ProductVersion')) and compare the build with the fixed build for your branch (GDR or CU). Lower than the fixed build means exposed. Exposure needs a login that can reach the server over the network.","fix":"Install the November 10, 2026 SQL Server security update for your branch: 2017 CU31 -> 14.0.3570.2; 2019 GDR -> 15.0.2210.4; 2019 CU32 -> 15.0.4510.2; 2022 GDR -> 16.0.1220.3; 2022 CU27 -> 16.0.4315.2 (KB5129300); 2025 GDR -> 17.0.1155.3; 2025 CU10 -> 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:24+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","triaged_at":"2026-11-10T19:30:25+00:00","updated_at":"2026-11-10T23:35:17+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:30:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: authorized user can escalate privileges over network","impact":"high","summary":"An untrusted pointer dereference in Microsoft SQL Server lets an attacker who already holds valid credentials raise their privileges. The attack can be launched over the network.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user gains higher database privileges than granted","analyst_note":"Check Microsoft's security update guide for affected SQL Server builds and the fixed cumulative update; the NVD entry alone gives no versions.","how_to_check":"- Confirm the SQL Server build with `SELECT @@VERSION` and compare it against Microsoft's security update guide entry for this CVE\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4488,"output_tokens":409,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for affected SQL Server builds and the fixed cumulative update; the NVD entry alone gives no versions.","search":"'-116934':13A,16A '-2026':12A,15A '-822':64B '10':88B '2017':20A '2019':25A,30A '2022':35A,40A '2025':45A,50A '2026':89B '8.8':81B 'allow':101C 'attack':104C 'authent':70B 'author':4A,103C 'cu10':51A 'cu27':41A 'cu31':21A 'cu32':31A 'cve':11A,14A 'cvss':80B 'cwe':63B 'derefer':62B,97C 'elev':106C 'escal':7A,75B 'exploit':93B 'fix':83B 'gdr':26A,36A,46A 'host':56B 'let':68B 'low':72B 'low-privileg':71B 'microsoft':1A,52B,82B 'network':10A,79B,110C 'novemb':87B 'pointer':61B,96C 'privileg':8A,73B,76B,107C 'report':94B 'secur':90B 'self':55B 'self-host':54B 'server':3A,19A,24A,29A,34A,39A,44A,49A,59B,67B,100C 'sql':2A,18A,23A,28A,33A,38A,43A,48A,58B,66B,99C 'sql-server':17A,22A,27A,32A,37A,42A,47A,57B 'untrust':60B,95C 'updat':91B 'user':5A,74B","nicknames":[],"mitigations":[],"who_affected":"Any self-managed SQL Server 2017, 2019, 2022 or 2025 instance (Windows or Linux) that is below the November 2026 fixed build. An attacker needs a valid low-privileged login and network access to the instance, then can raise their privileges. Instances where only trusted admins have logins, or that are not reachable from untrusted networks, are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017cu31","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["high","microsoft","other","selfhosted","sqlserver"],"campaign_type":null,"search_a":"'-116934':13A,16A '-2026':12A,15A '2017':20A '2019':25A,30A '2022':35A,40A '2025':45A,50A 'author':4A 'cu10':51A 'cu27':41A 'cu31':21A 'cu32':31A 'cve':11A,14A 'escal':7A 'gdr':26A,36A,46A 'microsoft':1A 'network':10A 'privileg':8A 'server':3A,19A,24A,29A,34A,39A,44A,49A 'sql':2A,18A,23A,28A,33A,38A,43A,48A 'sql-server':17A,22A,27A,32A,37A,42A,47A 'user':5A","search_b":"'-822':64B '10':88B '2026':89B '8.8':81B 'authent':70B 'cvss':80B 'cwe':63B 'derefer':62B 'escal':75B 'exploit':93B 'fix':83B 'host':56B 'let':68B 'low':72B 'low-privileg':71B 'microsoft':52B,82B 'network':79B 'novemb':87B 'pointer':61B 'privileg':73B,76B 'report':94B 'secur':90B 'self':55B 'self-host':54B 'server':59B,67B 'sql':58B,66B 'sql-server':57B 'untrust':60B 'updat':91B 'user':74B","search_c":"'allow':101C 'attack':104C 'author':103C 'derefer':97C 'elev':106C 'network':110C 'pointer':96C 'privileg':107C 'server':100C 'sql':99C 'untrust':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116934","severity":null,"published_at":"2026-11-10T19:19:24+00:00","modified_at":"2026-11-10T19:19:25+00:00","first_seen_at":"2026-11-10T19:24:46+00:00","fetched_at":"2026-11-10T19:24:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116934:3195","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:35:17+00:00","modified_at":"2026-11-10T23:35:17+00:00","first_seen_at":"2026-11-10T23:35:17+00:00","fetched_at":"2026-11-10T23:35:17+00:00","note":"Microsoft KB5129300 (SQL 2022 CU27 -> 16.0.4315.2) lists this CVE; other branches' fixed builds from the CNA record via OpenCVE (MSRC page not readable), so nothing marked verified. No exploitation or PoC seen.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-116934"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120376,"url":"https://app.opencve.io/cve/CVE-2026-116934","title":"OpenCVE: CVE-2026-116934 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}