What is the CVSS score of CVE-2026-26115?

CVE-2026-26115 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sql Server 2016 are affected by CVE-2026-26115?

A critical SQL Server vulnerability (CVE-2026-26115) allows authorized users to escalate privileges and gain unauthorized system access across the network.. A patch is available.

How to fix or mitigate CVE-2026-26115?

Within 24 hours: Inventory all SQL Server installations and document which versions are affected; restrict database access to only essential users and implement strict role-based access controls. Within 7 days: Deploy network segmentation to isolate SQL Server instances; enable enhanced logging and monitoring for privilege escalation attempts; conduct a security audit of current user permissions. Within 30 days: Evaluate vendor patch availability and test in non-production environments; develop incident response procedures specific to this vulnerability; consider migrating critical workloads to patched systems if alternative infrastructure exists.

Sql Server 2016 CVE-2026-26115

HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-03-10 secure@microsoft.com

Information Disclosure Sql Server 2016 Sql Server 2017 Sql Server 2019 Sql Server 2022 Sql Server 2025

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in SQL Server 2016-2025 stems from insufficient input validation, enabling authenticated network attackers to gain elevated permissions. The high CVSS score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, though no patch is currently available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privilege SQL Server user

Exploit

Submit crafted input bypassing type validation

Execution

Trigger privilege escalation logic

Impact

Gain high-privilege database access

Access

Authenticate as low-privilege SQL Server user

Exploit

Submit crafted input bypassing type validation

Execution

Trigger privilege escalation logic

Impact

Gain high-privilege database access

Vulnerability AssessmentAI

Exploitation	Attacker must possess valid SQL Server user credentials with initial database access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all SQL Server installations and document which versions are affected; restrict database access to only essential users and implement strict role-based access controls. …

Threat intelligence, references, and detailed analysis are available after sign-in.