{"id":"CVE-2026-118116","kind":"vulnerability","aliases":["CVE-2026-118116"],"related":[],"title":"SQL Server: SQL injection lets a low-privileged local user elevate privileges (fixed in November 2026 updates)","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.","summary":"SQL Server has an SQL injection flaw that lets a user with valid access run crafted SQL commands. An attacker can use it to elevate their privileges on the local machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2017","fixed":["14.0.2150.2","14.0.3570.2"],"affected":">= 14.0.0, < 14.0.2150.2 (GDR); >= 14.0.3006.16, < 14.0.3570.2 (CU31)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.2210.4","15.0.4510.2"],"affected":">= 15.0.0, < 15.0.2210.4 (GDR); >= 15.0.4003.23, < 15.0.4510.2 (CU32)","ecosystem":"vendor"},{"name":"sql-server-2022","fixed":["16.0.1220.3","16.0.4315.2"],"affected":">= 16.0.0, < 16.0.1220.3 (GDR); >= 16.0.4003.1, < 16.0.4315.2 (CU27)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.1155.3","17.0.5045.3"],"affected":">= 17.0.1050.2, < 17.0.1155.3 (GDR); >= 17.0.4006.0, < 17.0.5045.3 (CU10)","ecosystem":"vendor"}],"ecosystems":[],"tags":["linux","microsoft","runtime","self-hosted","sql-server","windows"],"not_affected_if":["auth-required"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) on each SQL Server instance and compare with the fixed builds: 2017 14.0.2150.2 (GDR) / 14.0.3570.2 (CU), 2019 15.0.2210.4 / 15.0.4510.2, 2022 16.0.1220.3 / 16.0.4315.2, 2025 17.0.1155.3 / 17.0.5045.3. Anything lower in its branch is affected. No workaround is documented by Microsoft in the pages read.","fix":"Install the November 10, 2026 SQL Server security update for your branch: 2017 GDR 14.0.2150.2 / CU31 branch 14.0.3570.2; 2019 GDR 15.0.2210.4 / CU32 branch 15.0.4510.2; 2022 GDR 16.0.1220.3 / CU27 branch 16.0.4315.2 (KB5129300, confirmed); 2025 GDR 17.0.1155.3 / CU10 branch 17.0.5045.3.","status":"open","published_at":"2026-11-10T19:19:30+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:52:09+00:00","updated_at":"2026-11-10T23:28:47+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T19:52:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SQL Server: SQL injection lets an authorized user gain local privileges","impact":"high","summary":"SQL Server has an SQL injection flaw that lets a user with valid access run crafted SQL commands. An attacker can use it to elevate their privileges on the local machine.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","microsoft"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authorized user escalates privileges on the local database host","analyst_note":"Find the Microsoft advisory for CVE-2026-118116 to confirm affected SQL Server versions, the fixed builds and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Microsoft SQL Server where some users hold legitimate database access. The sources do not state affected versions or configurations. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":4498,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118116 to confirm affected SQL Server versions, the fixed builds and any mitigation.","search":"'-118116':21A,24A '-2026':20A,23A '2017':28A '2019':32A '2022':36A '2025':40A '2026':17A 'access':64B 'allow':97C 'attack':70B,100C 'author':99C 'command':68B,91C 'craft':66B 'cve':19A,22A 'element':86C 'elev':12A,75B,102C 'fix':14A 'flaw':57B 'host':46B 'improp':82C 'inject':4A,56B,93C 'let':5A,59B 'linux':41B 'local':10A,80B,104C 'low':8A 'low-privileg':7A 'machin':81B 'microsoft':42B 'neutral':83C 'novemb':16A 'privileg':9A,13A,77B,103C 'run':65B 'runtim':43B 'self':45B 'self-host':44B 'server':2A,27A,31A,35A,39A,49B,52B,96C 'special':85C 'sql':1A,3A,26A,30A,34A,38A,48B,51B,55B,67B,90C,92C,95C 'sql-server':25A,29A,33A,37A,47B 'updat':18A 'use':72B,87C 'user':11A,61B 'valid':63B 'window':50B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed Microsoft SQL Server 2017, 2019, 2022 or 2025 where someone other than the admin has a login or local access. An attacker needs valid low-privileged access on the machine and the attack is rated high-complexity (CVSS 7.0, local). Not exploited and no public PoC found. Managed services where Microsoft patches the engine for you are not covered by the sources read.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:28:47Z","by":"analyst","doc":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","run_id":3174}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","linux","microsoft","runtime","selfhosted","sqlserver","windows"],"campaign_type":null,"search_a":"'-118116':21A,24A '-2026':20A,23A '2017':28A '2019':32A '2022':36A '2025':40A '2026':17A 'cve':19A,22A 'elev':12A 'fix':14A 'inject':4A 'let':5A 'local':10A 'low':8A 'low-privileg':7A 'novemb':16A 'privileg':9A,13A 'server':2A,27A,31A,35A,39A 'sql':1A,3A,26A,30A,34A,38A 'sql-server':25A,29A,33A,37A 'updat':18A 'user':11A","search_b":"'access':64B 'attack':70B 'command':68B 'craft':66B 'elev':75B 'flaw':57B 'host':46B 'inject':56B 'let':59B 'linux':41B 'local':80B 'machin':81B 'microsoft':42B 'privileg':77B 'run':65B 'runtim':43B 'self':45B 'self-host':44B 'server':49B,52B 'sql':48B,51B,55B,67B 'sql-server':47B 'use':72B 'user':61B 'valid':63B 'window':50B","search_c":"'allow':97C 'attack':100C 'author':99C 'command':91C 'element':86C 'elev':102C 'improp':82C 'inject':93C 'local':104C 'neutral':83C 'privileg':103C 'server':96C 'special':85C 'sql':90C,92C,95C 'use':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118116","severity":null,"published_at":"2026-11-10T19:19:30+00:00","modified_at":"2026-11-10T19:19:30+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118116:3174","url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","severity":null,"published_at":"2026-11-10T23:28:47+00:00","modified_at":"2026-11-10T23:28:47+00:00","first_seen_at":"2026-11-10T23:28:47+00:00","fetched_at":"2026-11-10T23:28:47+00:00","note":"KB5129300 (Microsoft) lists CVE-2026-118116 as fixed in SQL Server 2022 16.0.4315.2; other branch ranges/builds come from the Microsoft CNA record via OpenCVE (msrc page not retrievable), so only fix is marked verified, and only the 2022 build is from the KB itself.","cites":["https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","https://app.opencve.io/cve/CVE-2026-118116"]}],"documents":[{"id":120312,"url":"https://support.microsoft.com/en-us/servicing/sql/sql-server-2022/cumulative-update/kb5129300-cu27-gdr-november-2026","title":"KB5129300 SQL Server 2022 CU27 security update, Nov 10 2026","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120313,"url":"https://app.opencve.io/cve/CVE-2026-118116","title":"OpenCVE: CVE-2026-118116 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}