PT-2026-143703

CVE-2026-118115

Published

2026-11-10

Updated

2026-11-10

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions prior to 14.0.2150.2 Microsoft SQL Server versions prior to 14.0.3570.2

Description Improper neutralization of special elements used in an SQL command leads to an SQL injection, which allows an authorized attacker to elevate privileges over a network.

Recommendations Update to version 14.0.2150.2. Update to version 14.0.3570.2.

Exploitability

Fix

Impacts

Researchers

Hacnho

Le Nguyen Khang

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers