IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft SQL Server: Elevation of privilege via SQL injection

CVE-2026-118119High 8.0

← All vulnerabilities

Summary

A SQL injection flaw in Microsoft SQL Server (CWE-89) allows an authorized attacker to elevate privileges over the network. The attacker needs a valid database account with low privileges and user interaction is required according to the CVSS vector. Successful exploitation would give the attacker higher database rights than intended, which can expose or change data. The CVSS base score is 8.0 (High).

Affected

  • SQL Server 2017 (GDR): 14.0.0 to below 14.0.2150.2
  • SQL Server 2017 for x64-based Systems (CU31): 14.0.3006.16 to below 14.0.3570.2
  • SQL Server 2019 (GDR): 15.0.0 to below 15.0.2210.4
  • SQL Server 2019 for x64-based Systems (CU32): 15.0.4003.23 to below 15.0.4510.2
  • SQL Server 2022 (GDR): 16.0.0 to below 16.0.1220.3
  • SQL Server 2022 for x64-based Systems (CU27): 16.0.4003.1 to below 16.0.4315.2
  • SQL Server 2025 CU10: 17.0.4006.0 to below 17.0.5045.3
  • SQL Server 2025 for x64-based Systems (GDR): 17.0.1050.2 to below 17.0.1155.3

Fixed in

  • Fixed builds per CVE record: 14.0.2150.2 (2017 GDR), 14.0.3570.2 (2017 CU31), 15.0.2210.4 (2019 GDR), 15.0.4510.2 (2019 CU32), 16.0.1220.3 (2022 GDR), 16.0.4315.2 (2022 CU27), 17.0.5045.3 (2025 CU10), 17.0.1155.3 (2025 GDR)
  • Reported KB numbers from secondary sources, to be verified in the MSRC advisory: KB5132746 (2017 CU31), KB5132745 (2019 CU32), KB5129300 (2022 CU27), KB5129299 (2025 CU10)
  • KB numbers for the GDR branches: unknown.

Workaround

  • No vendor workaround found.
  • Unknown whether Microsoft documents a configuration-based mitigation. Check the MSRC advisory.

Exploitation

  • CISA SSVC: exploitation none, automatable no, technical impact total.
  • Rapid7 rates exploitation as less likely and reports no public disclosure.
  • The CVSS vector shows exploit code maturity unproven (E:U).
  • No public proof of concept or exploit found in the sources. Absence is not confirmed.

Our recommendation

  • Check whether your SQL Server builds fall within the affected ranges.
  • Install the security update for your branch, after checking the release notes and the servicing stack update requirement.
  • Until patched, restrict network access to SQL Server and limit which accounts can connect.
  • Review accounts with low privileges and remove unneeded database permissions.
  • Do not expose SQL Server to the internet. Prioritize internet-facing or multi-tenant instances.
  • Monitor for unusual privilege changes and failed or unexpected SQL activity.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – SQL Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
SQL Server
Updates (KB)
KB5129299, KB5132751, KB5132747, KB5132749, KB5129300, KB5132745

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:54.

Original description (NVD)

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed