{"id":"CVE-2026-118111","kind":"vulnerability","aliases":["CVE-2026-118111"],"related":[],"title":"Microsoft SQL Server: authorized user can gain higher privileges over network","description":"Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"An origin validation error in Microsoft SQL Server lets a user who already has an account raise their privileges across the network. The attacker would gain rights beyond what they were granted.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft","sql-server","vendor","windows"],"not_affected_if":["no-sql-server"],"how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds listed by Microsoft (unknown from these sources)\n- Review which logins hold elevated roles, since an authorized account is the starting point","fix":null,"status":"open","published_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","triaged_at":"2026-11-10T19:36:13+00:00","updated_at":"2026-11-10T19:36:13+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:36:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SQL Server: authorized user can gain higher privileges over network","impact":"high","summary":"An origin validation error in Microsoft SQL Server lets a user who already has an account raise their privileges across the network. The attacker would gain rights beyond what they were granted.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sql-server","microsoft","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Low-privileged account gains elevated database privileges over the network","analyst_note":"Find the affected SQL Server versions and Microsoft's fixed builds for CVE-2026-118111 at the MSRC advisory; the NVD entry gives no ranges or fix.","how_to_check":"- Check the SQL Server version with `SELECT @@VERSION` and compare it to the fixed builds listed by Microsoft (unknown from these sources)\n- Review which logins hold elevated roles, since an authorized account is the starting point","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server"],"who_is_affected":"Organizations running Microsoft SQL Server where some users or services hold valid accounts on a reachable server. The sources do not name affected versions or configuration, so the exact exposure is unknown. Systems with no SQL Server, or no network path for authenticated users, are unlikely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4478,"output_tokens":536,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected SQL Server versions and Microsoft's fixed builds for CVE-2026-118111 at the MSRC advisory; the NVD entry gives no ranges or fix.","search":"'-118111':14A,17A '-2026':13A,16A 'account':39B 'across':43B 'allow':62C 'alreadi':36B 'attack':47B,65C 'author':4A,64C 'beyond':51B 'cve':12A,15A 'elev':67C 'error':27B,58C 'gain':7A,49B 'grant':55B 'higher':8A 'let':32B 'microsoft':1A,18B,29B 'network':11A,45B,71C 'origin':25B,56C 'privileg':9A,42B,68C 'rais':40B 'right':50B 'server':3A,21B,31B,61C 'sql':2A,20B,30B,60C 'sql-server':19B 'user':5A,34B 'valid':26B,57C 'vendor':22B 'window':23B 'would':48B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microsoft SQL Server where some users or services hold valid accounts on a reachable server. The sources do not name affected versions or configuration, so the exact exposure is unknown. Systems with no SQL Server, or no network path for authenticated users, are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoft","sqlserver","vendor","windows"],"campaign_type":null,"search_a":"'-118111':14A,17A '-2026':13A,16A 'author':4A 'cve':12A,15A 'gain':7A 'higher':8A 'microsoft':1A 'network':11A 'privileg':9A 'server':3A 'sql':2A 'user':5A","search_b":"'account':39B 'across':43B 'alreadi':36B 'attack':47B 'beyond':51B 'error':27B 'gain':49B 'grant':55B 'let':32B 'microsoft':18B,29B 'network':45B 'origin':25B 'privileg':42B 'rais':40B 'right':50B 'server':21B,31B 'sql':20B,30B 'sql-server':19B 'user':34B 'valid':26B 'vendor':22B 'window':23B 'would':48B","search_c":"'allow':62C 'attack':65C 'author':64C 'elev':67C 'error':58C 'network':71C 'origin':56C 'privileg':68C 'server':61C 'sql':60C 'valid':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118111","severity":null,"published_at":"2026-11-10T19:19:29+00:00","modified_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:47+00:00","fetched_at":"2026-11-10T19:24:47+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}