{"id":"CVE-2026-118108","kind":"vulnerability","aliases":["CVE-2026-118108"],"related":[],"title":"SQL Server: improper authorization lets a logged-in user gain higher privileges","description":"Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Improper authorization in SQL Server lets an authenticated user elevate privileges over the network (CVSS 7.5, high attack complexity, low privileges required). Microsoft published it on 2026-11-10 for SQL Server 2017, 2019, 2022 and 2025. No exploitation reported; not in CISA KEV.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017 (GDR)","fixed":["14.0.2150.2"],"affected":">= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"SQL Server 2017 (CU31)","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"SQL Server 2019 (GDR)","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2019 (CU32)","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"SQL Server 2022 (GDR)","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2022 (CU27)","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"SQL Server 2025 (GDR)","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"},{"name":"SQL Server 2025 (CU10)","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","privilege-escalation","self-hosted","sql-server","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds. Fixed per Microsoft's CNA data: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3. Confirm the build on the MSRC page for this CVE.","fix":"Install the November 10, 2026 SQL Server security update for your branch (GDR or CU) to reach the build above. For 2022 CU27 that is KB5129300, build 16.0.4315.2. MSRC page not read, so confirm the KB for your branch there.","status":"open","published_at":"2026-11-10T19:19:28+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:44:46+00:00","updated_at":"2026-11-10T23:32:13+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:44:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: improper authorization lets a logged-in user gain higher privileges","impact":"high","summary":"SQL Server has an improper authorization flaw that lets an attacker who already has valid credentials raise their privileges over the network. The attacker would gain rights beyond what their account should allow.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker gains elevated database privileges over the network","analyst_note":"Check the Microsoft Security Response Center advisory for affected SQL Server versions, fixed builds and any required configuration.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000621,"input_tokens":4478,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for affected SQL Server versions, fixed builds and any required configuration.","search":"'-10':91B '-11':90B '-118108':16A,19A '-2026':15A,18A '2017':22A,26A,95B '2019':30A,34A,96B '2022':38A,42A,97B '2025':46A,50A,99B '2026':89B '7.5':78B 'allow':112C 'attack':80B,115C 'authent':70B 'author':4A,64B,108C,114C 'cisa':105B 'complex':81B 'cu10':51A 'cu27':43A 'cu31':27A 'cu32':35A 'cve':14A,17A 'cvss':77B 'elev':72B,117C 'escal':55B 'exploit':101B 'gain':11A 'gdr':23A,31A,39A,47A 'high':79B 'higher':12A 'host':58B 'improp':3A,63B,107C 'kev':106B 'let':5A,68B 'log':8A 'logged-in':7A 'low':82B 'microsoft':52B,85B 'network':76B,121C 'privileg':13A,54B,73B,83B,118C 'privilege-escal':53B 'publish':86B 'report':102B 'requir':84B 'self':57B 'self-host':56B 'server':2A,21A,25A,29A,33A,37A,41A,45A,49A,61B,67B,94B,111C 'sql':1A,20A,24A,28A,32A,36A,40A,44A,48A,60B,66B,93B,110C 'sql-server':59B 'user':10A,71B 'vendor':62B","nicknames":[],"mitigations":[],"who_affected":"Teams running their own SQL Server 2017, 2019, 2022 or 2025 below the fixed builds, where people or apps hold a valid SQL login. An attacker needs an account and the attack is rated high complexity. It matters most on servers shared by several apps or tenants. Managed services where the provider patches the engine can mostly skip it, but check the provider's notice.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2017cu31","server2017gdr","server2019cu32","server2019gdr","server2022cu27","server2022gdr","server2025cu10","server2025gdr","sqlserver2017cu31","sqlserver2017gdr","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["high","microsoft","privilegeescalation","selfhosted","sqlserver","vendor"],"campaign_type":null,"search_a":"'-118108':16A,19A '-2026':15A,18A '2017':22A,26A '2019':30A,34A '2022':38A,42A '2025':46A,50A 'author':4A 'cu10':51A 'cu27':43A 'cu31':27A 'cu32':35A 'cve':14A,17A 'gain':11A 'gdr':23A,31A,39A,47A 'higher':12A 'improp':3A 'let':5A 'log':8A 'logged-in':7A 'privileg':13A 'server':2A,21A,25A,29A,33A,37A,41A,45A,49A 'sql':1A,20A,24A,28A,32A,36A,40A,44A,48A 'user':10A","search_b":"'-10':91B '-11':90B '2017':95B '2019':96B '2022':97B '2025':99B '2026':89B '7.5':78B 'attack':80B 'authent':70B 'author':64B 'cisa':105B 'complex':81B 'cvss':77B 'elev':72B 'escal':55B 'exploit':101B 'high':79B 'host':58B 'improp':63B 'kev':106B 'let':68B 'low':82B 'microsoft':52B,85B 'network':76B 'privileg':54B,73B,83B 'privilege-escal':53B 'publish':86B 'report':102B 'requir':84B 'self':57B 'self-host':56B 'server':61B,67B,94B 'sql':60B,66B,93B 'sql-server':59B 'user':71B 'vendor':62B","search_c":"'allow':112C 'attack':115C 'author':108C,114C 'elev':117C 'improp':107C 'network':121C 'privileg':118C 'server':111C 'sql':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118108","severity":null,"published_at":"2026-11-10T19:19:28+00:00","modified_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118108:3183","url":"https://app.opencve.io/cve/CVE-2026-118108","severity":null,"published_at":"2026-11-10T23:32:13+00:00","modified_at":"2026-11-10T23:32:13+00:00","first_seen_at":"2026-11-10T23:32:13+00:00","fetched_at":"2026-11-10T23:32:13+00:00","note":"MSRC page did not render; affected ranges and fixed builds taken from Microsoft CNA data as mirrored by OpenCVE/NVD. KB5129300 (SQL 2022 CU27, 16.0.4315.2) does not list this CVE in the portion I read, so the fix mapping per KB is unconfirmed. Nothing marked verified. No exploitation or PoC found; MSRC exploitability not read.","cites":["https://app.opencve.io/cve/CVE-2026-118108","https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026"]}],"documents":[{"id":120343,"url":"https://app.opencve.io/cve/CVE-2026-118108","title":"OpenCVE: CVE-2026-118108 (mirrors Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}