CVE-2026-26115
Published: 10 March 2026
Description
Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation of information inputs, addressing the improper type validation that enables privilege escalation in SQL Server.
Requires timely remediation of flaws like this input validation vulnerability through patching as provided by Microsoft.
Enforces least privilege to limit the impact of low-privilege accounts exploiting the vulnerability for escalation.
Security SummaryAI
CVE-2026-26115 is an improper validation of specified type of input vulnerability affecting Microsoft SQL Server. Published on March 10, 2026, the issue stems from inadequate input checks, enabling privilege escalation, and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is classified under CWE-1287.
An authorized attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, specifically by elevating their privileges within the SQL Server environment.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26115 provides details on mitigations and available patches for addressing this vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability explicitly enables privilege escalation through exploitation of improper input validation in Microsoft SQL Server, directly mapping to T1068: Exploitation for Privilege Escalation.