{"id":"CVE-2026-118112","kind":"vulnerability","aliases":["CVE-2026-118112"],"related":[],"title":"SQL Server: code injection lets an authorized user gain higher privileges","description":"Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"Code injection (CWE-94) in SQL Server lets an authenticated user elevate privileges over the network. Microsoft rates it CVSS 8.0 and says user interaction is required. Fixed in the November 10, 2026 security updates. No exploitation or public PoC reported. Microsoft gives no trigger details.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"sql-server-2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","privilege-escalation","runtime","self-hosted","sql-server"],"not_affected_if":["managed-hosting","no-authenticated-users-untrusted"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed builds: 2017 GDR 14.0.2150.2, 2017 CU31 14.0.3570.2, 2019 GDR 15.0.2210.4, 2019 CU32 15.0.4510.2, 2022 GDR 16.0.1220.3, 2022 CU27 16.0.4315.2, 2025 GDR 17.0.1155.3, 2025 CU10 17.0.5045.3. Lower builds in the same branch are affected.","fix":"Install the November 2026 SQL Server security update for your branch (e.g. KB5129300 moves 2022 CU27 to 16.0.4315.2). Builds are in how-to-check.","status":"open","published_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:36:10+00:00","updated_at":"2026-11-10T23:31:17+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T19:36:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: code injection lets an authorized user gain higher privileges","impact":"high","summary":"SQL Server does not properly control code generation, which lets an attacker with a valid account raise their privileges over the network. The sources do not say which versions are affected or how the flaw is triggered.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated attacker gains elevated database privileges over network","analyst_note":"Find the Microsoft advisory for CVE-2026-118112 to confirm affected SQL Server versions, the fixed builds and any non-default configuration needed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-authenticated-users-untrusted"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":4491,"output_tokens":370,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118112 to confirm affected SQL Server versions, the fixed builds and any non-default configuration needed.","search":"'-118112':14A,17A '-2026':13A,16A '-94':48B '10':76B '2017':21A '2019':25A '2022':29A '2025':33A '2026':77B '8.0':65B 'allow':102C 'attack':105C 'authent':54B 'author':7A,104C 'code':3A,45B,96C,97C 'control':92C 'cve':12A,15A 'cvss':64B 'cwe':47B 'detail':90B 'elev':56B,107C 'escal':37B 'exploit':81B 'fix':72B 'gain':9A 'generat':94C 'give':87B 'higher':10A 'host':41B 'improp':91C 'inject':4A,46B,98C 'interact':69B 'let':5A,52B 'microsoft':34B,61B,86B 'network':60B,111C 'novemb':75B 'poc':84B 'privileg':11A,36B,57B,108C 'privilege-escal':35B 'public':83B 'rate':62B 'report':85B 'requir':71B 'runtim':38B 'say':67B 'secur':78B 'self':40B 'self-host':39B 'server':2A,20A,24A,28A,32A,44B,51B,101C 'sql':1A,19A,23A,27A,31A,43B,50B,100C 'sql-server':18A,22A,26A,30A,42B 'trigger':89B 'updat':79B 'user':8A,55B,68B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance below the November 2026 fixed builds, where an attacker already holds a valid login. Self-hosted and VM-hosted instances are the ones to check. Teams with no SQL Server, or only managed cloud database services that Microsoft patches, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","microsoft","privilegeescalation","runtime","selfhosted","sqlserver"],"campaign_type":null,"search_a":"'-118112':14A,17A '-2026':13A,16A '2017':21A '2019':25A '2022':29A '2025':33A 'author':7A 'code':3A 'cve':12A,15A 'gain':9A 'higher':10A 'inject':4A 'let':5A 'privileg':11A 'server':2A,20A,24A,28A,32A 'sql':1A,19A,23A,27A,31A 'sql-server':18A,22A,26A,30A 'user':8A","search_b":"'-94':48B '10':76B '2026':77B '8.0':65B 'authent':54B 'code':45B 'cvss':64B 'cwe':47B 'detail':90B 'elev':56B 'escal':37B 'exploit':81B 'fix':72B 'give':87B 'host':41B 'inject':46B 'interact':69B 'let':52B 'microsoft':34B,61B,86B 'network':60B 'novemb':75B 'poc':84B 'privileg':36B,57B 'privilege-escal':35B 'public':83B 'rate':62B 'report':85B 'requir':71B 'runtim':38B 'say':67B 'secur':78B 'self':40B 'self-host':39B 'server':44B,51B 'sql':43B,50B 'sql-server':42B 'trigger':89B 'updat':79B 'user':55B,68B","search_c":"'allow':102C 'attack':105C 'author':104C 'code':96C,97C 'control':92C 'elev':107C 'generat':94C 'improp':91C 'inject':98C 'network':111C 'privileg':108C 'server':101C 'sql':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118112","severity":null,"published_at":"2026-11-10T19:19:29+00:00","modified_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118112:3179","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:31:17+00:00","modified_at":"2026-11-10T23:31:17+00:00","first_seen_at":"2026-11-10T23:31:17+00:00","fetched_at":"2026-11-10T23:31:17+00:00","note":"Builds from Microsoft CNA data (via OpenCVE; MSRC page is JS-only and unreadable). Fix for 2022 CU27 confirmed on KB5129300 (16.0.4315.2); other fixed builds not read on a vendor page, so nothing marked verified. No exploitation or PoC found; no non-default config stated.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-118112"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120341,"url":"https://app.opencve.io/cve/CVE-2026-118112","title":"OpenCVE: CVE-2026-118112 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}