Microsoft SQL Server: Elevation of privilege due to improper authorization
Summary
Microsoft SQL Server contains an improper authorization flaw that allows an authorized attacker with network access to elevate privileges. The attacker needs a valid low-privileged account and a network path to the SQL Server, and the attack complexity is high with no user interaction required. The CVSS score is 7.5 (High), and NVD analysis was still pending at the time of research.
Affected
- SQL Server 2017 (GDR): 14.0.0 to below 14.0.2150.2
- SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to below 14.0.3570.2
- SQL Server 2019 (GDR): 15.0.0 to below 15.0.2210.4
- SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to below 15.0.4510.2
- SQL Server 2022 (GDR): 16.0.0 to below 16.0.1220.3
- SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to below 16.0.4315.2
- SQL Server 2025 CU10: 17.0.4006.0 to below 17.0.5045.3
- SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to below 17.0.1155.3
Fixed in
- Install the Microsoft security update for your branch, which provides builds at or above the upper bounds listed under affected (for example 14.0.2150.2, 15.0.2210.4, 16.0.1220.3, 17.0.1155.3). Verify on MSRC.
- KB article numbers: Unknown.
Workaround
Unknown. No vendor workaround was found because a patch is listed.
- General hardening (not from the advisory): limit sysadmin-level roles and review accounts with elevated rights.
Exploitation
- No in-the-wild exploitation is known in the sources.
- No public proof of concept was found.
- CISA SSVC: exploitation none, not automatable, technical impact total.
- Rapid7 rates exploitation as less likely.
Our recommendation
- Patch affected SQL Server instances in the next maintenance window, following the MSRC guidance for each branch. Raise the priority if instances are reachable from user networks or are internet-facing.
- Inventory SQL Server versions and verify build numbers against MSRC.
- Review accounts that can authenticate to affected instances, especially SQL logins used by web applications, and remove unneeded elevated roles.
- Monitor for unusual privilege changes and logins.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118108 msrc.microsoft.com
- CVE.org record CVE-2026-118108 www.cve.org
- Strix AI: CVE-2026-118108 www.strix.ai
- Threat Intelligence mirror: CVE-2026-118108 cve.threatint.com
- Rapid7: Patch Tuesday November 2026 review www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:41.
Original description (NVD)
Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.