What is the CVSS score of CVE-2026-26116?

CVE-2026-26116 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sql Server 2016 are affected by CVE-2026-26116?

A SQL injection vulnerability in SQL Server allows authorized users to escalate their privileges and potentially compromise sensitive data or system integrity.. A patch is available.

How to fix or mitigate CVE-2026-26116?

Within 24 hours: Identify all SQL Server instances in your environment and document which versions are affected; restrict database access to only essential personnel and disable unnecessary database features. Within 7 days: Implement input validation and parameterized queries in all applications connecting to affected SQL Server instances; deploy WAF rules to detect and block SQL injection patterns. Within 30 days: Establish a vendor monitoring process for patch availability; conduct a security assessment of all database-connected applications; consider network segmentation to limit lateral movement if compromise occurs.

Sql Server 2016 CVE-2026-26116

HIGH

SQL Injection (CWE-89)

2026-03-10 secure@microsoft.com

SQLi Sql Server 2016 Sql Server 2017 Sql Server 2019 Sql Server 2022 Sql Server 2025

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Authenticated users can exploit SQL injection vulnerabilities in SQL Server 2016-2025 to escalate privileges and gain unauthorized access across the network. This high-severity flaw (CVSS 8.8) affects multiple SQL Server versions with no available patch, allowing attackers with valid credentials to manipulate SQL commands and compromise system integrity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privilege SQL Server user

Delivery

Inject malicious SQL commands via vulnerable input

Exploit

Bypass authentication checks

Execution

Execute commands as elevated user

Impact

Escalate privileges

Access

Authenticate as low-privilege SQL Server user

Delivery

Inject malicious SQL commands via vulnerable input

Exploit

Bypass authentication checks

Execution

Execute commands as elevated user

Impact

Escalate privileges

Vulnerability AssessmentAI

Exploitation	Authenticated access to SQL Server required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A remote attacker could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all SQL Server instances in your environment and document which versions are affected; restrict database access to only essential personnel and disable unnecessary database features. …

Threat intelligence, references, and detailed analysis are available after sign-in.