What is the CVSS score of CVE-2026-26115?

CVE-2026-26115 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sql Server 2019 are affected by CVE-2026-26115?

A critical SQL Server vulnerability (CVE-2026-26115) allows authorized users to escalate privileges and gain unauthorized system access across the network.. A patch is available.

How to fix or mitigate CVE-2026-26115?

Within 24 hours: Inventory all SQL Server installations and document which versions are affected; restrict database access to only essential users and implement strict role-based access controls. Within 7 days: Deploy network segmentation to isolate SQL Server instances; enable enhanced logging and monitoring for privilege escalation attempts; conduct a security audit of current user permissions. Within 30 days: Evaluate vendor patch availability and test in non-production environments; develop incident response procedures specific to this vulnerability; consider migrating critical workloads to patched systems if alternative infrastructure exists.

Sql Server 2019 CVE-2026-26115

HIGH

Improper Validation of Specified Type of Input (CWE-1287)

2026-03-10 secure@microsoft.com

Information Disclosure Sql Server 2019 Sql Server 2022 Sql Server 2017 Sql Server 2016 Sql Server 2025

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in SQL Server 2016-2025 stems from insufficient input validation, enabling authenticated network attackers to gain elevated permissions. The high CVSS score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, though no patch is currently available. Organizations running affected SQL Server versions should prioritize access controls and network segmentation until remediation is released.