CVE-2026-118118
A NVD · · CVE-2026-118118
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.0
- EPSS
- 0%
Key insight
Notably, exploitation requires an already authenticated account , the flaw therefore serves primarily for privilege escalation inside the database rather than for initial access.
Description
CVE-2026-118118 describes an SQL injection vulnerability in Microsoft SQL Server caused by improper neutralization of special elements in SQL commands. An already authenticated attacker can exploit the flaw over the network to elevate privileges. Because exploitation requires valid credentials, the primary risk lies in privilege escalation within the database environment. At the time of the report, there is no information about active exploitation or a published exploit.
Risk score
- cvss base
- 80.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 80.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational