---
id: "CVE-2026-118117"
page: "https://infrastack.ai/live/CVE-2026-118117"
kind: "vulnerability"
aliases: ["CVE-2026-118117"]
title: "SQL Server: SQL injection lets an authorized user gain higher privileges"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["microsoft", "runtime", "sql-server"]
not_affected_if: []
published_at: "2026-11-10T19:19:30+00:00"
first_seen_at: "2026-11-10T19:24:48+00:00"
updated_at: "2026-11-10T19:36:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118117", "first_seen_at": "2026-11-10T19:24:48+00:00"}]
exploit_sources: []
---

# SQL Server: SQL injection lets an authorized user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-118117 (this .md is for agents)

SQL Server does not properly neutralize special characters in SQL commands, which allows injection of SQL. An authorized attacker on the network can use it to elevate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118117

## From the sources

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_