{"id":"CVE-2026-118119","kind":"vulnerability","aliases":["CVE-2026-118119"],"related":[],"title":"SQL Server: SQL injection lets a logged-in user gain higher privileges over the network (fixed in November 2026 updates)","description":"Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.","summary":"SQL Server does not properly neutralize special characters in SQL commands, a flaw known as SQL injection. An attacker with a valid account can use it over the network to elevate their privileges.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sql-server-2017","fixed":["14.0.3570.2","14.0.2150.2"],"affected":"< 14.0.3570.2 (CU31 path), < 14.0.2150.2 (GDR path)","ecosystem":"vendor"},{"name":"sql-server-2019","fixed":["15.0.4510.2","15.0.2210.4"],"affected":"< 15.0.4510.2 (CU32 path), < 15.0.2210.4 (GDR path)","ecosystem":"vendor"},{"name":"sql-server-2022","fixed":["16.0.4315.2","16.0.1220.3"],"affected":"< 16.0.4315.2 (CU27 path), < 16.0.1220.3 (GDR path)","ecosystem":"vendor"},{"name":"sql-server-2025","fixed":["17.0.5045.3","17.0.1155.3"],"affected":"< 17.0.5045.3 (CU10 path), < 17.0.1155.3 (GDR path)","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","privilege-escalation","runtime","self-hosted","sql-injection","sql-server"],"not_affected_if":["no-sql-server","patched-build"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the fixed build for your branch. Fixed builds, CU path: 2017 CU31 14.0.3570.2 (KB5132746); 2019 CU32 15.0.4510.2 (KB5132745); 2022 CU27 16.0.4315.2 (KB5129300); 2025 CU10 17.0.5045.3 (KB5129299). GDR path: 2017 14.0.2150.2 (KB5132749); 2019 15.0.2210.4 (KB5132751); 2022 16.0.1220.3 (KB5132747); 2025 17.0.1155.3 (KB5132748). Builds below these on the same branch are affected. Source: Microsoft CNA data in NVD plus a third-party mirror of the MSRC table; the MSRC page itself could not be read. KB5129300 lists known issue with sys.dm_exec_requests during recovery (trace flag 4696 opts out).","fix":"Install the November 10, 2026 SQL Server security update for your branch: CU path 14.0.3570.2 / 15.0.4510.2 / 16.0.4315.2 / 17.0.5045.3; GDR path 14.0.2150.2 / 15.0.2210.4 / 16.0.1220.3 / 17.0.1155.3.","status":"open","published_at":"2026-11-10T19:19:30+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:36:07+00:00","updated_at":"2026-11-10T23:26:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T19:36:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SQL Server: SQL injection lets an authorized user gain higher privileges over network","impact":"high","summary":"SQL Server does not properly neutralize special characters in SQL commands, a flaw known as SQL injection. An attacker with a valid account can use it over the network to elevate their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sql-server","microsoft","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user gains elevated database privileges over the network","analyst_note":"Find the affected SQL Server versions, the fixed builds and the Microsoft advisory for CVE-2026-118119; the NVD entry alone gives no versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sql-server"],"who_is_affected":"Organizations running Microsoft SQL Server where users have network access to the database with some valid account. The sources do not name affected versions or specific configurations, so the exact exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4499,"output_tokens":445,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected SQL Server versions, the fixed builds and the Microsoft advisory for CVE-2026-118119; the NVD entry alone gives no versions or fix.","search":"'-118119':24A,27A '-2026':23A,26A '2017':31A '2019':35A '2022':39A '2025':43A '2026':20A 'account':80B 'allow':106C 'attack':76B,109C 'author':108C 'charact':65B 'command':68B,100C 'cve':22A,25A 'element':95C 'elev':88B,111C 'escal':47B 'fix':17A 'flaw':70B 'gain':11A 'higher':12A 'host':51B 'improp':91C 'inject':4A,54B,74B,102C 'known':71B 'let':5A 'log':8A 'logged-in':7A 'microsoft':44B 'network':16A,86B,115C 'neutral':63B,92C 'novemb':19A 'privileg':13A,46B,90B,112C 'privilege-escal':45B 'proper':62B 'runtim':48B 'self':50B 'self-host':49B 'server':2A,30A,34A,38A,42A,57B,59B,105C 'special':64B,94C 'sql':1A,3A,29A,33A,37A,41A,53B,56B,58B,67B,73B,99C,101C,104C 'sql-inject':52B 'sql-server':28A,32A,36A,40A,55B 'updat':21A 'use':82B,96C 'user':10A 'valid':79B","nicknames":[],"mitigations":[],"who_affected":"Any SQL Server 2017, 2019, 2022 or 2025 instance you run yourself (Windows or Linux) on a build older than the November 10, 2026 security update for its CU or GDR branch. An attacker needs a valid login and some user interaction (CVSS UI:R). Managed cloud database services were not named in the sources I read; check the vendor page before assuming they are safe or affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["sqlserver2017","sqlserver2019","sqlserver2022","sqlserver2025"],"ptokens":["2017","2019","2022","2025","server","sql"],"labels":["high","microsoft","privilegeescalation","runtime","selfhosted","sqlinjection","sqlserver"],"campaign_type":null,"search_a":"'-118119':24A,27A '-2026':23A,26A '2017':31A '2019':35A '2022':39A '2025':43A '2026':20A 'cve':22A,25A 'fix':17A 'gain':11A 'higher':12A 'inject':4A 'let':5A 'log':8A 'logged-in':7A 'network':16A 'novemb':19A 'privileg':13A 'server':2A,30A,34A,38A,42A 'sql':1A,3A,29A,33A,37A,41A 'sql-server':28A,32A,36A,40A 'updat':21A 'user':10A","search_b":"'account':80B 'attack':76B 'charact':65B 'command':68B 'elev':88B 'escal':47B 'flaw':70B 'host':51B 'inject':54B,74B 'known':71B 'microsoft':44B 'network':86B 'neutral':63B 'privileg':46B,90B 'privilege-escal':45B 'proper':62B 'runtim':48B 'self':50B 'self-host':49B 'server':57B,59B 'special':64B 'sql':53B,56B,58B,67B,73B 'sql-inject':52B 'sql-server':55B 'use':82B 'valid':79B","search_c":"'allow':106C 'attack':109C 'author':108C 'command':100C 'element':95C 'elev':111C 'improp':91C 'inject':102C 'network':115C 'neutral':92C 'privileg':112C 'server':105C 'special':94C 'sql':99C,101C,104C 'use':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118119","severity":null,"published_at":"2026-11-10T19:19:30+00:00","modified_at":"2026-11-10T19:19:30+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118119:3171","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118119","severity":null,"published_at":"2026-11-10T23:26:39+00:00","modified_at":"2026-11-10T23:26:39+00:00","first_seen_at":"2026-11-10T23:26:39+00:00","fetched_at":"2026-11-10T23:26:39+00:00","note":"Versions and fixed builds from NVD (Microsoft CNA data) and a mirror of the MSRC table. MSRC update-guide page is JS-only and unreachable; KB5129300 summary did not list this CVE in what I read. Nothing verified. Not exploited per CISA KEV/notcve; no PoC found. X and social not searched. Affected ranges are lower-bound-as-published; CU ranges start at the lowest build NVD lists. Sibling CVEs 118117/118118 have the same pattern.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118119","https://kerteszmihaly.com/sql-server/vulnerabilities"]}],"documents":[{"id":120159,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118119","title":"NVD CVE-2026-118119 (Microsoft CNA affected list)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120160,"url":"https://kerteszmihaly.com/sql-server/vulnerabilities","title":"SQL Server CVE list mirroring MSRC (builds and KBs)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}