What is the CVSS score of CVE-2026-26116?

CVE-2026-26116 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Sql Server 2022 are affected by CVE-2026-26116?

A SQL injection vulnerability in SQL Server allows authorized users to escalate their privileges and potentially compromise sensitive data or system integrity.. A patch is available.

How to fix or mitigate CVE-2026-26116?

Within 24 hours: Identify all SQL Server instances in your environment and document which versions are affected; restrict database access to only essential personnel and disable unnecessary database features. Within 7 days: Implement input validation and parameterized queries in all applications connecting to affected SQL Server instances; deploy WAF rules to detect and block SQL injection patterns. Within 30 days: Establish a vendor monitoring process for patch availability; conduct a security assessment of all database-connected applications; consider network segmentation to limit lateral movement if compromise occurs.

Sql Server 2022 CVE-2026-26116

HIGH

SQL Injection (CWE-89)

2026-03-10 secure@microsoft.com

SQLi Sql Server 2022 Sql Server 2025 Sql Server 2016 Sql Server 2019 Sql Server 2017

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.8

DescriptionCVE.org

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Authenticated users can exploit SQL injection vulnerabilities in SQL Server 2016-2025 to escalate privileges and gain unauthorized access across the network. This high-severity flaw (CVSS 8.8) affects multiple SQL Server versions with no available patch, allowing attackers with valid credentials to manipulate SQL commands and compromise system integrity. Organizations running these affected versions should implement network segmentation and monitor for suspicious database activity until a patch is released.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.