{"id":"CVE-2026-118110","kind":"vulnerability","aliases":["CVE-2026-118110"],"related":[],"title":"Microsoft SQL Server: SQL injection lets an authorized user gain privileges","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"SQL injection in SQL Server lets an authenticated low-privileged user elevate privileges over the network (CVSS 8.8). Microsoft published fixed builds on 10 Nov 2026 for SQL Server 2017, 2019, 2022 and 2025. No exploitation reported; the vulnerable feature is not named.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017 GDR","fixed":["14.0.2150.2"],"affected":">= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"SQL Server 2017 CU31","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"SQL Server 2019 GDR","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2019 CU32","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"SQL Server 2022 GDR","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2022 CU27","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"SQL Server 2025 CU10","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"},{"name":"SQL Server 2025 GDR","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","infrastructure","microsoft","self-hosted","sql-server"],"not_affected_if":[],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 GDR 14.0.2150.2 / CU31 14.0.3570.2; 2019 GDR 15.0.2210.4 / CU32 15.0.4510.2; 2022 GDR 16.0.1220.3 / CU27 16.0.4315.2; 2025 GDR 17.0.1155.3 / CU10 17.0.5045.3. A lower build on the same branch is exposed.","fix":"Install the November 2026 SQL Server security update for your branch (GDR or CU): 2017 14.0.2150.2 / 14.0.3570.2, 2019 15.0.2210.4 / 15.0.4510.2, 2022 16.0.1220.3 / 16.0.4315.2, 2025 17.0.1155.3 / 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:30:19+00:00","updated_at":"2026-11-10T23:32:21+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:30:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: SQL injection lets an authorized user gain privileges","impact":"high","summary":"SQL Server does not properly neutralize special characters in SQL commands, which allows an authorized attacker to inject SQL. The attacker can elevate their privileges over the network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user elevates privileges on the database server","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-118110 to get affected versions, the fixed build and the vulnerable feature.","how_to_check":"- Check the installed SQL Server version and compare it against Microsoft's security update list for this CVE.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any SQL Server instance where an authorized user can reach the vulnerable query path over the network may be affected. The sources do not name affected versions or the specific feature involved. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4499,"output_tokens":441,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-118110 to get affected versions, the fixed build and the vulnerable feature.","search":"'-118110':14A,17A '-2026':13A,16A '10':85B '2017':20A,24A,91B '2019':28A,32A,92B '2022':36A,40A,93B '2025':44A,48A,95B '2026':87B '8.8':79B 'allow':120C 'attack':123C 'auth':51B 'auth-requir':50B 'authent':68B 'author':8A,122C 'build':83B 'command':114C 'cu10':45A 'cu27':41A 'cu31':25A 'cu32':33A 'cve':12A,15A 'cvss':78B 'element':109C 'elev':73B,125C 'exploit':97B 'featur':101B 'fix':82B 'gain':10A 'gdr':21A,29A,37A,49A 'host':57B 'improp':105C 'infrastructur':53B 'inject':5A,62B,116C 'let':6A,66B 'low':70B 'low-privileg':69B 'microsoft':1A,54B,80B 'name':104B 'network':77B,129C 'neutral':106C 'nov':86B 'privileg':11A,71B,74B,126C 'publish':81B 'report':98B 'requir':52B 'self':56B 'self-host':55B 'server':3A,19A,23A,27A,31A,35A,39A,43A,47A,60B,65B,90B,119C 'special':108C 'sql':2A,4A,18A,22A,26A,30A,34A,38A,42A,46A,59B,61B,64B,89B,113C,115C,118C 'sql-server':58B 'use':110C 'user':9A,72B 'vulner':100B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance below the fixed build is affected. The attacker needs a valid login with low privileges and network access to the instance. Instances that only trusted admins can log in to carry less risk, but patch anyway.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2017cu31","server2017gdr","server2019cu32","server2019gdr","server2022cu27","server2022gdr","server2025cu10","server2025gdr","sqlserver2017cu31","sqlserver2017gdr","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["authrequired","high","infrastructure","microsoft","selfhosted","sqlserver"],"campaign_type":null,"search_a":"'-118110':14A,17A '-2026':13A,16A '2017':20A,24A '2019':28A,32A '2022':36A,40A '2025':44A,48A 'author':8A 'cu10':45A 'cu27':41A 'cu31':25A 'cu32':33A 'cve':12A,15A 'gain':10A 'gdr':21A,29A,37A,49A 'inject':5A 'let':6A 'microsoft':1A 'privileg':11A 'server':3A,19A,23A,27A,31A,35A,39A,43A,47A 'sql':2A,4A,18A,22A,26A,30A,34A,38A,42A,46A 'user':9A","search_b":"'10':85B '2017':91B '2019':92B '2022':93B '2025':95B '2026':87B '8.8':79B 'auth':51B 'auth-requir':50B 'authent':68B 'build':83B 'cvss':78B 'elev':73B 'exploit':97B 'featur':101B 'fix':82B 'host':57B 'infrastructur':53B 'inject':62B 'let':66B 'low':70B 'low-privileg':69B 'microsoft':54B,80B 'name':104B 'network':77B 'nov':86B 'privileg':71B,74B 'publish':81B 'report':98B 'requir':52B 'self':56B 'self-host':55B 'server':60B,65B,90B 'sql':59B,61B,64B,89B 'sql-server':58B 'user':72B 'vulner':100B","search_c":"'allow':120C 'attack':123C 'author':122C 'command':114C 'element':109C 'elev':125C 'improp':105C 'inject':116C 'network':129C 'neutral':106C 'privileg':126C 'server':119C 'special':108C 'sql':113C,115C,118C 'use':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118110","severity":null,"published_at":"2026-11-10T19:19:29+00:00","modified_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118110:3181","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118110","severity":null,"published_at":"2026-11-10T23:32:21+00:00","modified_at":"2026-11-10T23:32:21+00:00","first_seen_at":"2026-11-10T23:32:21+00:00","fetched_at":"2026-11-10T23:32:21+00:00","note":"MSRC page is JS-only and unreadable; ranges/fixed builds taken from Microsoft CNA data as mirrored on NVD/OpenCVE (same lists). Not marked verified. Feature/component not named by Microsoft; no exploitation or PoC found (not in KEV).","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118110","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118110"]}],"documents":[{"id":120345,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118110","title":"NVD CVE-2026-118110 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120347,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118110","title":"MSRC CVE-2026-118110 (JS-only, not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}