CVE-2026-118109
A NVD · · CVE-2026-118109
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 8.8
- EPSS
- 0%
Key insight
The item is the plain NVD record and provides no indication of active exploitation, PoC code or affected sectors , it therefore adds nothing beyond patch information.
Description
Vulnerability CVE-2026-118109 affects Microsoft SQL Server and is an improper neutralization of special elements in SQL commands (SQL injection). An attacker who already holds valid credentials can exploit the flaw over the network to elevate privileges on the affected system. Exploitation therefore requires authenticated access; unauthenticated exploitation is not described. The entry contains no CVSS severity rating, no list of affected versions and no indication of known exploitation in the wild (KEV) or public proof-of-concept code. There is also no information on specific attack campaigns or targeted sectors.
Risk score
- cvss base
- 88.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 88.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational