{"id":"CVE-2026-118114","kind":"vulnerability","aliases":["CVE-2026-118114"],"related":[],"title":"SQL Server: SQL injection lets an authorized user gain higher privileges","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"SQL injection in SQL Server (CWE-89) lets a logged-in, low-privilege user raise their privileges over the network. CVSS 7.5, attack complexity high. Microsoft fixed it in the November 2026 security updates for SQL Server 2017, 2019, 2022 and 2025.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SQL Server 2017 CU31","fixed":["14.0.3570.2"],"affected":">= 14.0.3006.16, < 14.0.3570.2","ecosystem":"vendor"},{"name":"SQL Server 2017 GDR","fixed":["14.0.2150.2"],"affected":">= 14.0.0, < 14.0.2150.2","ecosystem":"vendor"},{"name":"SQL Server 2019 CU32","fixed":["15.0.4510.2"],"affected":">= 15.0.4003.23, < 15.0.4510.2","ecosystem":"vendor"},{"name":"SQL Server 2019 GDR","fixed":["15.0.2210.4"],"affected":">= 15.0.0, < 15.0.2210.4","ecosystem":"vendor"},{"name":"SQL Server 2022 CU27","fixed":["16.0.4315.2"],"affected":">= 16.0.4003.1, < 16.0.4315.2","ecosystem":"vendor"},{"name":"SQL Server 2022 GDR","fixed":["16.0.1220.3"],"affected":">= 16.0.0, < 16.0.1220.3","ecosystem":"vendor"},{"name":"SQL Server 2025 CU10","fixed":["17.0.5045.3"],"affected":">= 17.0.4006.0, < 17.0.5045.3","ecosystem":"vendor"},{"name":"SQL Server 2025 GDR","fixed":["17.0.1155.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["database","microsoft","privilege-escalation","runtime","self-hosted","sql-server"],"not_affected_if":["managed-hosting","no-authenticated-users","no-network-access","no-sql-server"],"how_to_check":"Run SELECT @@VERSION; (or SERVERPROPERTY('ProductVersion')) and compare the build with the fixed build for your branch (CU or GDR). Anything below it is affected.","fix":"Install the November 10, 2026 SQL Server security update for your branch: 2017 CU31 -> 14.0.3570.2; 2017 GDR -> 14.0.2150.2; 2019 CU32 -> 15.0.4510.2; 2019 GDR -> 15.0.2210.4; 2022 CU27 -> 16.0.4315.2 (KB5129300); 2022 GDR -> 16.0.1220.3; 2025 CU10 -> 17.0.5045.3; 2025 GDR -> 17.0.1155.3.","status":"open","published_at":"2026-11-10T19:19:29+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:44:46+00:00","updated_at":"2026-11-10T23:29:08+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-11-10T19:44:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: SQL injection lets an authorized user gain higher privileges","impact":"high","summary":"SQL Server does not neutralize special characters in some SQL commands, so a user with an account can inject SQL. An attacker can use this to raise their privileges over the network.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","microsoft","database"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker elevates privileges across the database server","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118114 for affected SQL Server versions, the fixed build and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-network-access","no-authenticated-users"],"who_is_affected":"Organizations running Microsoft SQL Server where users hold valid database accounts that can reach the server over the network. The sources do not name the affected versions or the specific feature. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4499,"output_tokens":419,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-118114 for affected SQL Server versions, the fixed build and any mitigation.","search":"'-118114':14A,17A '-2026':13A,16A '-89':68B '2017':20A,24A,101B '2019':28A,32A,102B '2022':36A,40A,103B '2025':44A,48A,105B '2026':95B '7.5':85B 'allow':121C 'attack':86B,124C 'author':7A,123C 'command':115C 'complex':87B 'cu10':45A 'cu27':37A 'cu31':21A 'cu32':29A 'cve':12A,15A 'cvss':84B 'cwe':67B 'databas':50B 'element':110C 'elev':126C 'escal':54B 'fix':90B 'gain':9A 'gdr':25A,33A,41A,49A 'high':88B 'higher':10A 'host':58B 'improp':106C 'inject':4A,63B,117C 'let':5A,69B 'log':72B 'logged-in':71B 'low':75B 'low-privileg':74B 'microsoft':51B,89B 'network':83B,130C 'neutral':107C 'novemb':94B 'privileg':11A,53B,76B,80B,127C 'privilege-escal':52B 'rais':78B 'runtim':55B 'secur':96B 'self':57B 'self-host':56B 'server':2A,19A,23A,27A,31A,35A,39A,43A,47A,61B,66B,100B,120C 'special':109C 'sql':1A,3A,18A,22A,26A,30A,34A,38A,42A,46A,60B,62B,65B,99B,114C,116C,119C 'sql-server':59B 'updat':97B 'use':111C 'user':8A,77B","nicknames":[],"mitigations":[],"who_affected":"Any self-managed SQL Server 2017, 2019, 2022 or 2025 instance (Windows or Linux) below the November 2026 build is affected. The attacker needs a valid login, so servers where untrusted or many users have accounts matter most. Teams that use only a managed cloud database and do not run SQL Server themselves can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server2017cu31","server2017gdr","server2019cu32","server2019gdr","server2022cu27","server2022gdr","server2025cu10","server2025gdr","sqlserver2017cu31","sqlserver2017gdr","sqlserver2019cu32","sqlserver2019gdr","sqlserver2022cu27","sqlserver2022gdr","sqlserver2025cu10","sqlserver2025gdr"],"ptokens":["2017","2019","2022","2025","cu10","cu27","cu31","cu32","gdr","server","sql"],"labels":["database","high","microsoft","privilegeescalation","runtime","selfhosted","sqlserver"],"campaign_type":null,"search_a":"'-118114':14A,17A '-2026':13A,16A '2017':20A,24A '2019':28A,32A '2022':36A,40A '2025':44A,48A 'author':7A 'cu10':45A 'cu27':37A 'cu31':21A 'cu32':29A 'cve':12A,15A 'gain':9A 'gdr':25A,33A,41A,49A 'higher':10A 'inject':4A 'let':5A 'privileg':11A 'server':2A,19A,23A,27A,31A,35A,39A,43A,47A 'sql':1A,3A,18A,22A,26A,30A,34A,38A,42A,46A 'user':8A","search_b":"'-89':68B '2017':101B '2019':102B '2022':103B '2025':105B '2026':95B '7.5':85B 'attack':86B 'complex':87B 'cvss':84B 'cwe':67B 'databas':50B 'escal':54B 'fix':90B 'high':88B 'host':58B 'inject':63B 'let':69B 'log':72B 'logged-in':71B 'low':75B 'low-privileg':74B 'microsoft':51B,89B 'network':83B 'novemb':94B 'privileg':53B,76B,80B 'privilege-escal':52B 'rais':78B 'runtim':55B 'secur':96B 'self':57B 'self-host':56B 'server':61B,66B,100B 'sql':60B,62B,65B,99B 'sql-server':59B 'updat':97B 'user':77B","search_c":"'allow':121C 'attack':124C 'author':123C 'command':115C 'element':110C 'elev':126C 'improp':106C 'inject':117C 'network':130C 'neutral':107C 'privileg':127C 'server':120C 'special':109C 'sql':114C,116C,119C 'use':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118114","severity":null,"published_at":"2026-11-10T19:19:29+00:00","modified_at":"2026-11-10T19:19:30+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118114:3176","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:29:08+00:00","modified_at":"2026-11-10T23:29:08+00:00","first_seen_at":"2026-11-10T23:29:08+00:00","fetched_at":"2026-11-10T23:29:08+00:00","note":"Fix builds from Microsoft CNA data (via OpenCVE/NVD); only the 2022 CU27 build 16.0.4315.2 confirmed on a Microsoft KB (KB5129300). MSRC page not readable, so nothing marked verified. No exploitation or PoC seen (KEV false, CVSS E:U).","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-118114"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120316,"url":"https://app.opencve.io/cve/CVE-2026-118114","title":"OpenCVE: CVE-2026-118114 (Microsoft CNA affected ranges)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}