---
id: "CVE-2026-118110"
page: "https://infrastack.ai/live/CVE-2026-118110"
kind: "vulnerability"
aliases: ["CVE-2026-118110"]
title: "Microsoft SQL Server: SQL injection lets an authorized user gain privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "microsoft", "sql-server"]
not_affected_if: []
published_at: "2026-11-10T19:19:29+00:00"
first_seen_at: "2026-11-10T19:24:47+00:00"
updated_at: "2026-11-10T19:30:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118110", "first_seen_at": "2026-11-10T19:24:47+00:00"}]
exploit_sources: []
---

# Microsoft SQL Server: SQL injection lets an authorized user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-118110 (this .md is for agents)

SQL Server does not properly neutralize special characters in SQL commands, which allows an authorized attacker to inject SQL. The attacker can elevate their privileges over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SQL Server version and compare it against Microsoft's security update list for this CVE.

## Timeline

- 2026-11-10T19:24:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118110

## From the sources

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_