{"id":"CVE-2026-118109","kind":"vulnerability","aliases":["CVE-2026-118109"],"related":[],"title":"Microsoft SQL Server: SQL injection lets an authorized user gain privileges","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft SQL Server has an SQL injection flaw that lets an authorized attacker raise their privileges over the network. An attacker needs a valid account on the server to use it.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017 GDR","fixed":["14.0.2150.2"],"affected":">= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"SQL Server 2017 CU31","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"SQL Server 2019 GDR","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2019 CU32","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"SQL Server 2022 GDR","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2022 CU27","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"SQL Server 2025 GDR","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"},{"name":"SQL Server 2025 CU10","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","microsoft","self-hosted","sql-server","windows"],"not_affected_if":["no-authorized-users-on-server","patched-november-2026"],"how_to_check":"Run SELECT @@VERSION; (or SERVERPROPERTY('ProductVersion')) in SSMS or sqlcmd and compare with the fixed builds. Affected: below 14.0.2150.2 (2017 GDR), below 14.0.3570.2 (2017 CU31), below 15.0.2210.4 (2019 GDR), below 15.0.4510.2 (2019 CU32), below 16.0.1220.3 (2022 GDR), below 16.0.4315.2 (2022 CU27), below 17.0.1155.3 (2025 GDR), below 17.0.5045.3 (2025 CU10). Use the GDR or CU row that matches your servicing track.","fix":"Install the November 10, 2026 SQL Server security update for your branch. GDR track: 2017 14.0.2150.2, 2019 15.0.2210.4, 2022 16.0.1220.3, 2025 17.0.1155.3. CU track: 2017 CU31 14.0.3570.2, 2019 CU32 15.0.4510.2, 2022 CU27 16.0.4315.2, 2025 CU10 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:30:20+00:00","updated_at":"2026-11-10T23:32:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:30:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: SQL injection lets an authorized user gain privileges","impact":"high","summary":"Microsoft SQL Server has an SQL injection flaw that lets an authorized attacker raise their privileges over the network. An attacker needs a valid account on the server to use it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","microsoft","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user gains higher database privileges over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118109 for affected builds and the fixed update.","how_to_check":"- Identify SQL Server instances and their versions with `SELECT @@VERSION;` in SQL Server Management Studio or sqlcmd\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-authorized-users-on-server"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4499,"output_tokens":409,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118109 for affected builds and the fixed update.","search":"'-118109':14A,17A '-2026':13A,16A '2017':20A,24A '2019':28A,32A '2022':36A,40A '2025':44A,48A 'account':83B 'allow':104C 'attack':71B,79B,107C 'author':8A,70B,106C 'command':98C 'cu10':49A 'cu27':41A 'cu31':25A 'cu32':33A 'cve':12A,15A 'element':93C 'elev':109C 'flaw':66B 'gain':10A 'gdr':21A,29A,37A,45A 'host':54B 'improp':89C 'infrastructur':50B 'inject':5A,65B,100C 'let':6A,68B 'microsoft':1A,51B,59B 'need':80B 'network':77B,113C 'neutral':90C 'privileg':11A,74B,110C 'rais':72B 'self':53B 'self-host':52B 'server':3A,19A,23A,27A,31A,35A,39A,43A,47A,57B,61B,86B,103C 'special':92C 'sql':2A,4A,18A,22A,26A,30A,34A,38A,42A,46A,56B,60B,64B,97C,99C,102C 'sql-server':55B 'use':88B,94C 'user':9A 'valid':82B 'window':58B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance on a build below the November 2026 update, reachable over the network by someone with a valid login. An attacker with low privileges can use SQL injection to gain higher privileges. Teams with no untrusted or low-privilege logins on the server face less risk, but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2017cu31","server2017gdr","server2019cu32","server2019gdr","server2022cu27","server2022gdr","server2025cu10","server2025gdr","sqlserver2017cu31","sqlserver2017gdr","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["high","infrastructure","microsoft","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-118109':14A,17A '-2026':13A,16A '2017':20A,24A '2019':28A,32A '2022':36A,40A '2025':44A,48A 'author':8A 'cu10':49A 'cu27':41A 'cu31':25A 'cu32':33A 'cve':12A,15A 'gain':10A 'gdr':21A,29A,37A,45A 'inject':5A 'let':6A 'microsoft':1A 'privileg':11A 'server':3A,19A,23A,27A,31A,35A,39A,43A,47A 'sql':2A,4A,18A,22A,26A,30A,34A,38A,42A,46A 'user':9A","search_b":"'account':83B 'attack':71B,79B 'author':70B 'flaw':66B 'host':54B 'infrastructur':50B 'inject':65B 'let':68B 'microsoft':51B,59B 'need':80B 'network':77B 'privileg':74B 'rais':72B 'self':53B 'self-host':52B 'server':57B,61B,86B 'sql':56B,60B,64B 'sql-server':55B 'use':88B 'valid':82B 'window':58B","search_c":"'allow':104C 'attack':107C 'author':106C 'command':98C 'element':93C 'elev':109C 'improp':89C 'inject':100C 'network':113C 'neutral':90C 'privileg':110C 'server':103C 'special':92C 'sql':97C,99C,102C 'use':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118109","severity":null,"published_at":"2026-11-10T19:19:29+00:00","modified_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118109:3182","url":"https://app.opencve.io/cve/CVE-2026-118109","severity":null,"published_at":"2026-11-10T23:32:16+00:00","modified_at":"2026-11-10T23:32:16+00:00","first_seen_at":"2026-11-10T23:32:16+00:00","fetched_at":"2026-11-10T23:32:16+00:00","note":"MSRC page is JS-only and unreadable here; ranges come from Microsoft's CNA data via OpenCVE, fix builds match Microsoft's SQL Server latest-updates page. Nothing verified. Not exploited, no PoC found. KB5129300 (2022 CU27) summary did not list this CVE in the snippet I saw, so the KB per branch is unconfirmed.","cites":["https://app.opencve.io/cve/CVE-2026-118109","https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates"]}],"documents":[{"id":120346,"url":"https://app.opencve.io/cve/CVE-2026-118109","title":"OpenCVE: CVE-2026-118109 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117576,"url":"https://support.microsoft.com/en-us/servicing/sql/kb321185-download-and-install-latest-updates","title":"Latest updates and version history for SQL Server","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}