Microsoft SQL Server: Privilege escalation due to untrusted pointer dereference
Summary
Microsoft SQL Server contains an untrusted pointer dereference (CWE-822) that allows an authorized attacker to elevate privileges over the network. The attacker needs valid credentials with low privileges, for example from a compromised database or application account, and no user interaction is required. If exploited, the impact on confidentiality, integrity and availability is rated high (CVSS 8.8).
Affected
- SQL Server 2017 for x64 (CU31): 14.0.3006.16 to < 14.0.3570.2 (entry unconfirmed, see note)
- SQL Server 2019 (GDR): 15.0.0 to < 15.0.2210.4
- SQL Server 2019 for x64 (CU32): 15.0.4003.23 to < 15.0.4510.2
- SQL Server 2022 (GDR): 16.0.0 to < 16.0.1220.3
- SQL Server 2022 for x64 (CU27): 16.0.4003.1 to < 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to < 17.0.5045.3
- SQL Server 2025 for x64 (GDR): 17.0.1050.2 to < 17.0.1155.3
- Other branches (e.g. 2016 and older): Unknown.
Note: The version ranges come from the CVE record and a third-party aggregator; they have not been confirmed against the MSRC advisory.
Fixed in
- SQL Server 2025 for x64 (GDR): Update KB5132748 (November 2026), reported fixed build 17.0.1155.3 (not yet confirmed by MSRC)
- Other branches: Unknown. Check the MSRC advisory and the matching cumulative update KB articles.
Workaround
Unknown. No workaround or mitigation has been published in the sources reviewed.
Exploitation
- Exploited in the wild: No evidence found.
- Public proof of concept: None found.
- CISA SSVC: Exploitation none, not automatable, total technical impact.
- Status may change quickly, as the advisory was published on the same day.
Our recommendation
- Inventory all SQL Server instances and their versions, including instances embedded in vendor applications.
- Apply the vendor update for each branch in the next maintenance window; for SQL Server 2025 GDR use KB5132748.
- Restrict logins to the required accounts and review service and application accounts for shared or weak credentials.
- Do not expose SQL Server instances to user networks unnecessarily.
- Recheck the MSRC advisory once it is fully published and verify the affected and fixed versions.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-116934 msrc.microsoft.com
- Strix: CVE-2026-116934 (version data, third-party) www.strix.ai
- Microsoft KB5132748: SQL Server 2025 GDR update, November 2026 support.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:35.
Original description (NVD)
Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.