{"id":"CVE-2026-118105","kind":"vulnerability","aliases":["CVE-2026-118105"],"related":[],"title":"SQL Server: SQL injection lets an authorized user gain higher privileges","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"SQL injection in SQL Server (CWE-89) lets an authenticated low-privileged user elevate privileges over the network. Microsoft rates it CVSS 8.8, exploitation unlikely at release (E:U); no public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"SQL Server 2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"SQL Server 2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"SQL Server 2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","microsoft","privilege-escalation","runtime","self-hosted","sql-server"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3. Anything older on the same branch is affected.","fix":"Install the November 10, 2026 SQL Server security update for your branch (GDR or CU): 2017 14.0.2150.2 / 14.0.3570.2, 2019 15.0.2210.4 / 15.0.4510.2, 2022 16.0.1220.3 / 16.0.4315.2, 2025 17.0.1155.3 / 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:30:22+00:00","updated_at":"2026-11-10T23:33:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T19:30:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: SQL injection lets an authorized user gain higher privileges","impact":"high","summary":"SQL Server does not properly neutralize special characters in SQL commands, so a user with valid access can inject SQL. An attacker who can reach the server over the network can use this to elevate their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","microsoft","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user escalates privileges on the database server","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118105 for affected versions, the fixed build and any non-default configuration required.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server that accept network connections from users with valid accounts. The sources do not name affected versions or the specific feature involved. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4499,"output_tokens":405,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118105 for affected versions, the fixed build and any non-default configuration required.","search":"'-118105':14A,17A '-2026':13A,16A '-89':48B '2017':20A '2019':23A '2022':26A '2025':29A '8.8':65B 'allow':91C 'attack':94C 'authent':51B 'author':7A,93C 'command':85C 'cve':12A,15A 'cvss':64B 'cwe':47B 'databas':30B 'e':70B 'element':80C 'elev':56B,96C 'escal':34B 'exploit':66B 'found':75B 'gain':9A 'higher':10A 'host':38B 'improp':76C 'inject':4A,43B,87C 'let':5A,49B 'low':53B 'low-privileg':52B 'microsoft':31B,61B 'network':60B,100C 'neutral':77C 'poc':74B 'privileg':11A,33B,54B,57B,97C 'privilege-escal':32B 'public':73B 'rate':62B 'releas':69B 'runtim':35B 'self':37B 'self-host':36B 'server':2A,19A,22A,25A,28A,41B,46B,90C 'special':79C 'sql':1A,3A,18A,21A,24A,27A,40B,42B,45B,84C,86C,89C 'sql-server':39B 'u':71B 'unlik':67B 'use':81C 'user':8A,55B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server that accept network connections from users with valid accounts. The sources do not name affected versions or the specific feature involved. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2017","server2019","server2022","server2025","sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["database","high","microsoft","privilegeescalation","runtime","selfhosted","sqlserver"],"campaign_type":null,"search_a":"'-118105':14A,17A '-2026':13A,16A '2017':20A '2019':23A '2022':26A '2025':29A 'author':7A 'cve':12A,15A 'gain':9A 'higher':10A 'inject':4A 'let':5A 'privileg':11A 'server':2A,19A,22A,25A,28A 'sql':1A,3A,18A,21A,24A,27A 'user':8A","search_b":"'-89':48B '8.8':65B 'authent':51B 'cvss':64B 'cwe':47B 'databas':30B 'e':70B 'elev':56B 'escal':34B 'exploit':66B 'found':75B 'host':38B 'inject':43B 'let':49B 'low':53B 'low-privileg':52B 'microsoft':31B,61B 'network':60B 'poc':74B 'privileg':33B,54B,57B 'privilege-escal':32B 'public':73B 'rate':62B 'releas':69B 'runtim':35B 'self':37B 'self-host':36B 'server':41B,46B 'sql':40B,42B,45B 'sql-server':39B 'u':71B 'unlik':67B 'user':55B","search_c":"'allow':91C 'attack':94C 'author':93C 'command':85C 'element':80C 'elev':96C 'improp':76C 'inject':87C 'network':100C 'neutral':77C 'privileg':97C 'server':90C 'special':79C 'sql':84C,86C,89C 'use':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118105","severity":null,"published_at":"2026-11-10T19:19:28+00:00","modified_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118105:3185","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118105","severity":null,"published_at":"2026-11-10T23:33:18+00:00","modified_at":"2026-11-10T23:33:18+00:00","first_seen_at":"2026-11-10T23:33:18+00:00","fetched_at":"2026-11-10T23:33:18+00:00","note":"Microsoft CNA data (via OpenCVE/NVD mirror; MSRC page is JS-only and unreadable here) gives affected/fixed builds for SQL Server 2017-2025. Not verified: no vendor page text read. No exploitation or PoC found (KEV false, CVSS E:U). The KB5129300 (2022 CU27) list I read did not show this CVE in the visible part, so I did not tie 16.0.4315.2 to it beyond the CNA record.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118105","https://app.opencve.io/cve/CVE-2026-118105"]}],"documents":[{"id":120353,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118105","title":"MSRC: CVE-2026-118105 Microsoft SQL Server Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120354,"url":"https://app.opencve.io/cve/CVE-2026-118105","title":"OpenCVE: CVE-2026-118105 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}