CVE-2026-116930

Microsoft SQL Server Remote code execution in database engine

high · 8.8

Fix listed

Microsoft SQL Server

Published Nov 10, 2026, 18:24 UTC

Description

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.

Reported fixed versions

14.0.2150.2, 14.0.3570.2, 15.0.2210.4, 15.0.4510.2, 16.0.1220.3

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.