Cyber Posture

CVE-2026-26115

High

Published: 10 March 2026

Published
10 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mandates validation of information inputs, addressing the improper type validation that enables privilege escalation in SQL Server.

prevent

Requires timely remediation of flaws like this input validation vulnerability through patching as provided by Microsoft.

prevent

Enforces least privilege to limit the impact of low-privilege accounts exploiting the vulnerability for escalation.

Security SummaryAI

CVE-2026-26115 is an improper validation of specified type of input vulnerability affecting Microsoft SQL Server. Published on March 10, 2026, the issue stems from inadequate input checks, enabling privilege escalation, and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is classified under CWE-1287.

An authorized attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, specifically by elevating their privileges within the SQL Server environment.

Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26115 provides details on mitigations and available patches for addressing this vulnerability.

Details

CWE(s)

Affected Products

microsoft
sql server 2016
13.0.6300.2 — 13.0.6480.4 · 13.0.7000.253 — 13.0.7075.5
microsoft
sql server 2017
14.0.1000.169 — 14.0.2100.4 · 14.0.3006.16 — 14.0.3520.4
microsoft
sql server 2019
15.0.2000.5 — 15.0.2160.4 · 15.0.4003.23 — 15.0.4460.4
microsoft
sql server 2022
16.0.1000.6 — 16.0.1170.5 · 16.0.4003.1 — 16.0.4240.4
microsoft
sql server 2025
17.0.1000.7 — 17.0.1050.2 · 17.0.4006.2 — 17.0.4020.2

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The vulnerability explicitly enables privilege escalation through exploitation of improper input validation in Microsoft SQL Server, directly mapping to T1068: Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References