---
id: "CVE-2026-118118"
page: "https://infrastack.ai/live/CVE-2026-118118"
kind: "vulnerability"
aliases: ["CVE-2026-118118"]
title: "Microsoft SQL Server: SQL injection lets an authorized user gain privileges"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["microsoft", "other", "sql-server"]
not_affected_if: []
published_at: "2026-11-10T19:19:30+00:00"
first_seen_at: "2026-11-10T19:24:48+00:00"
updated_at: "2026-11-10T19:36:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118118", "first_seen_at": "2026-11-10T19:24:48+00:00"}]
exploit_sources: []
---

# Microsoft SQL Server: SQL injection lets an authorized user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-118118 (this .md is for agents)

Microsoft SQL Server does not properly neutralize special characters in SQL commands, so SQL injection is possible. An authorized attacker on the network can use it to elevate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118118

## From the sources

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_