← back
CVE-2026-26115

SQL Server Elevation of Privilege Vulnerability

CVSS 8.8 HIGHEPSS 1.1%CWE-1287
In short

SQL Server fails to properly validate certain user inputs, allowing someone with legitimate access to gain higher privileges on the system over a network. This means an authorized user could become an administrator without permission.

Technical detail

An authenticated attacker can exploit improper input validation in SQL Server to escalate privileges over the network. The vulnerability requires valid credentials but allows lateral privilege elevation, potentially leading to full administrative control of the SQL Server instance.

Summary generated and translated by AI from the official description.
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →