---
id: "CVE-2026-118115"
page: "https://infrastack.ai/live/CVE-2026-118115"
kind: "vulnerability"
aliases: ["CVE-2026-118115"]
title: "Microsoft SQL Server: SQL injection lets an authorized user gain higher privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "sql-server-2017", "fixed": ["14.0.2150.2", "14.0.3570.2"], "affected": "GDR >= 14.0.0, < 14.0.2150.2; CU31 >= 14.0.3006.16, < 14.0.3570.2", "ecosystem": "vendor"}, {"name": "sql-server-2022", "fixed": ["16.0.1220.3", "16.0.4315.2"], "affected": "GDR >= 16.0.0, < 16.0.1220.3; CU27 >= 16.0.4003.1, < 16.0.4315.2", "ecosystem": "vendor"}, {"name": "sql-server-2025", "fixed": ["17.0.1155.3", "17.0.5045.3"], "affected": "GDR >= 17.0.1050.2, < 17.0.1155.3; CU10 >= 17.0.4006.0, < 17.0.5045.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["database", "microsoft", "self-hosted", "sql-server", "vendor"]
not_affected_if: ["auth-required"]
published_at: "2026-11-10T19:19:30+00:00"
first_seen_at: "2026-11-10T19:24:48+00:00"
updated_at: "2026-11-10T23:29:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118115", "first_seen_at": "2026-11-10T19:24:48+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-118115", "first_seen_at": "2026-11-10T23:29:00+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-118115", "https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026"]}]
exploit_sources: []
---

# Microsoft SQL Server: SQL injection lets an authorized user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-118115 (this .md is for agents)

Microsoft SQL Server mishandles special characters in SQL commands, a classic SQL injection flaw. An attacker who already has a valid account can use it over the network to elevate their privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:sql-server-2017 affected GDR >= 14.0.0, < 14.0.2150.2; CU31 >= 14.0.3006.16, < 14.0.3570.2 fixed 14.0.2150.2, 14.0.3570.2
- vendor:sql-server-2022 affected GDR >= 16.0.0, < 16.0.1220.3; CU27 >= 16.0.4003.1, < 16.0.4315.2 fixed 16.0.1220.3, 16.0.4315.2
- vendor:sql-server-2025 affected GDR >= 17.0.1050.2, < 17.0.1155.3; CU10 >= 17.0.4006.0, < 17.0.5045.3 fixed 17.0.1155.3, 17.0.5045.3

## How to check

Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed build for your branch. Affected: 2017 GDR 14.0.0 to below 14.0.2150.2; 2017 CU31 14.0.3006.16 to below 14.0.3570.2; 2022 GDR 16.0.0 to below 16.0.1220.3; 2022 CU27 16.0.4003.1 to below 16.0.4315.2; 2025 GDR 17.0.1050.2 to below 17.0.1155.3; 2025 CU10 17.0.4006.0 to below 17.0.5045.3. SQL Server 2019 and 2016 are not listed in the record.

## Fix

Install the November 10, 2026 SQL Server security update for your branch: 2017 GDR 14.0.2150.2 / CU31+GDR 14.0.3570.2; 2022 GDR 16.0.1220.3 / CU27+GDR 16.0.4315.2 (KB5129300); 2025 GDR 17.0.1155.3 / CU10+GDR 17.0.5045.3. Builds per the CVE record as mirrored by OpenCVE; not yet confirmed on Microsoft's own page.

## Timeline

- 2026-11-10T19:24:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118115
- 2026-11-10T23:29:00+00:00 analyst https://app.opencve.io/cve/CVE-2026-118115 — Microsoft MSRC page unreadable by tools; versions/builds come from CNA record via OpenCVE, so nothing verified. KB5129300 (2022 CU27 16.0.4315.2) is Microsoft's own page but does not list this CVE in its advisory list. No exploitation or PoC found. Revisit when MSRC entry is readable.

## Documents

- [describes] OpenCVE: CVE-2026-118115 (mirrors Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-118115
- [mentions] KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026 https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026

## From the sources

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_