Skip to content

CVE record · 1 source

CVE-2026-118112

CVSS 8.0

Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Vendor: Microsoft
Product: Microsoft SQL Server 2017 (GDR), Microsoft SQL Server 2017 for x64-based Systems (CU31), Microsoft SQL Server 2019 (GDR), Microsoft SQL Server 2019 for x64-based Systems (CU32)
CVSS v3.1: 8.0 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-94
Exposure class: Database

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

39

CVE NVD 5h ago

Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

CVSS 8.0 CVE-2026-118112 Microsoft