Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-116945: Microsoft SQL Server lets attackers run code remotely

CVE-2026-116945 · published 1 day ago

Summary

SQL Server versions 2017, 2019 and 2022 can be tricked into running malicious code from another computer on the network. This could let an unauthorized person take control of the database server. Install the latest security updates from Microsoft as soon as possible.

What to do

Update microsoft microsoft sql server 2017 (gdr) to version 14.0.2150.2 or later.
Update microsoft microsoft sql server 2017 for x64-based systems (cu31) to version 14.0.3570.2 or later.
Update microsoft microsoft sql server 2019 (gdr) to version 15.0.2210.4 or later.
Update microsoft microsoft sql server 2019 for x64-based systems (cu32) to version 15.0.4510.2 or later.
Update microsoft microsoft sql server 2022 (gdr) to version 16.0.1220.3 or later.
Update microsoft microsoft sql server 2022 for x64-based systems (cu27) to version 16.0.4315.2 or later.
Update microsoft microsoft sql server 2025 cu10 to version 17.0.5045.3 or later.
Update microsoft microsoft sql server 2025 for x64-based systems (gdr) to version 17.0.1155.3 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft sql server 2017 (gdr)	< 14.0.2150.2
microsoft	microsoft sql server 2017 for x64-based systems (cu31)	< 14.0.3570.2
microsoft	microsoft sql server 2019 (gdr)	< 15.0.2210.4
microsoft	microsoft sql server 2019 for x64-based systems (cu32)	< 15.0.4510.2
microsoft	microsoft sql server 2022 (gdr)	< 16.0.1220.3
microsoft	microsoft sql server 2022 for x64-based systems (cu27)	< 16.0.4315.2
microsoft	microsoft sql server 2025 cu10	< 17.0.5045.3
microsoft	microsoft sql server 2025 for x64-based systems (gdr)	< 17.0.1155.3

Original advisory text

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116945 vendor-advisory patch

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published10 Nov 2026

Updated12 Nov 2026

First seen10 Nov 2026

Sources

CVE-2026-116945 · NVD

CVE-2026-116945 · MITRE

Track software like this

Free during beta