Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a command injection flaw in SQL Server that can lead to remote code execution once a user opens an attacker-supplied file. Microsoft shipped eight separate security updates spanning SQL Server 2017 through 2025 on Windows and Linux, so most of the practical work for defenders lies in matching each instance to the correct servicing branch and confirming it reaches the fixed build.
The input data for this CVE lists the vendor as Unknown. The CVE record identifies Microsoft Corporation as the CNA and the product as Microsoft SQL Server, so we treat Microsoft as the confirmed vendor throughout.
Technical information
Root cause
Microsoft and NVD describe CVE-2026-116930 as improper neutralization of special elements used in a command, classified as CWE-77. MITRE defines CWE-77 as constructing a command from externally influenced input without correctly neutralizing elements that can change the intended command. That category covers custom command languages as well as operating system command strings, so the classification alone does not tell us which interpreter is involved.
Somewhere in SQL Server, data that an attacker can influence reaches a command without its special characters being neutralized, and that content can be interpreted as part of the command rather than as data. The stated consequence is code execution by an unauthorized attacker.
SQL Server is closed source and the fix ships only as signed binary updates, so there is no public commit, diff or vulnerable code snippet to examine.
Scoring
Microsoft, acting as CNA, published this CVSS 3.1 base vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector: Network (reachable remotely under the stated conditions)
- Attack complexity: Low
- Privileges required: None
- User interaction: Required (another user must take an action)
- Scope: Unchanged
- Confidentiality, Integrity, Availability: High for all three
This yields 8.8. Microsoft's own severity label is Important. That label comes from a separate rating system and does not conflict with the score. NVD has not yet calculated an independent score and marks the record Awaiting Enrichment, so the 8.8 is Microsoft's number.
Attack flow as Microsoft describes it
The MSRC FAQ states that successful exploitation requires a user to open a specially crafted file from the attacker. Based on that statement, the publicly supported sequence is:
- The attacker prepares a file whose content includes special elements that SQL Server fails to neutralize when that content is used in a command.
- The file reaches a user. Microsoft does not document the delivery mechanism.
- The user opens the file.
- The unneutralized content alters the command, resulting in code execution with high confidentiality, integrity and availability impact.
The vector combines network reachability with required user interaction. The advisory does not support reading AV:N as meaning an arbitrary unauthenticated network request triggers execution on its own.
What is not disclosed
Microsoft does not identify the file extension or payload format, the vulnerable function, the exact command syntax, the execution account, or a network port, and it does not document a complete exploitation chain. We therefore make no claims about a specific shell, SQL statement, attachment vector, or execution as SYSTEM.
Disclosure and exploitation status
Microsoft credits Piotr Bazydlo (@chudypb) and Anonymous in its acknowledgments. These are research credits and do not attribute the issue to any threat actor. At original publication Microsoft marked the issue as not publicly disclosed and not exploited, assessed it as Exploitation Less Likely, and set the temporal Exploit Code Maturity metric to Unproven, meaning no public exploit code is available or an exploit is theoretical. ZDI's November 2026 review lists it the same way, and Senserva and VulDB report no CISA KEV listing.
Patch information
Microsoft fixed CVE-2026-116930 in its November 10, 2026 SQL Server security updates. MSRC rates the remediation level Official Fix and lists eight updates covering every supported servicing branch from SQL Server 2017 through 2025. No separate CVE-specific workaround is published.
Pick the update by servicing branch, not product year
Each major version ships two update tracks:
- GDR (General Distribution Release): security fixes and other broadly applicable critical fixes only. Shown below as RTM+GDR.
- CU+GDR: the security fix layered on top of the cumulative update branch.
The update you need depends on which track the instance is already on. Microsoft's FAQ points to KB 321185 for reading the version, edition and update level. The MSRC applicability ranges are:
- SQL Server 2025 CU10+GDR, KB5129299: fixed build 17.0.5045.3, for current builds 17.0.4006.2 through 17.0.5035.5
- SQL Server 2025 RTM+GDR, KB5132748: fixed build 17.0.1155.3, for current builds 17.0.1000.7 through 17.0.1145.4
- SQL Server 2022 CU27+GDR, KB5129300: fixed build 16.0.4315.2, for current builds 16.0.4003.1 through 16.0.4305.5
- SQL Server 2022 RTM+GDR, KB5132747: fixed build 16.0.1220.3, for current builds 16.0.1000.6 through 16.0.1210.3
- SQL Server 2019 CU32+GDR, KB5132745: fixed build 15.0.4510.2, for current builds 15.0.4003.23 through 15.0.4500.2
- SQL Server 2019 RTM+GDR, KB5132751: fixed build 15.0.2210.4, for current builds 15.0.2000.5 through 15.0.2200.2
- SQL Server 2017 CU31+GDR, KB5132746: fixed build 14.0.3570.2, for current builds 14.0.3006.16 through 14.0.3560.2
- SQL Server 2017 RTM+GDR, KB5132749: fixed build 14.0.2150.2, for current builds 14.0.1000.169 through 14.0.2140.2
Any build at or above the fixed number for its branch includes the patch. The fixed builds are not interchangeable across branches of the same product year.
What the KB packages contain
KB5129299 (SQL Server 2025) and KB5129300 (SQL Server 2022) both list CVE-2026-116930 among more than 30 SQL Server CVEs fixed in this release. Their fix tables reference only internal bug numbers and do not map changes to CVEs. Several entries describe input-handling hardening consistent with a command injection fix:
- better handling of object names in internal stored procedures
- stronger input validation for PolyBase stored procedures
- an Integration Services change that disables XSLT scripting by default (bug 5623673 in SQL Server 2025, bug 5656899 in SQL Server 2022)
After the update, the SSIS XML task no longer runs script embedded in XSLT stylesheets unless an administrator turns it back on through the EnableXsltScript registry value under HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\{version}\SSIS\XMLTask. Microsoft has not published a CVE-to-bug mapping, so treat any link between these items and CVE-2026-116930 as our inference rather than a confirmed root cause fix. Test packages that rely on XSLT scripting before rollout.
Delivery and integrity
- Channels: Windows Update, the Microsoft Update Catalog, and the Microsoft Download Center. On Linux, the fix arrives through the configured CU package repository using the platform-specific package update procedure.
- SHA256 for the SQL Server 2025 KB5129299 x64 package:
64AC66C63E7037F8578B3C2CB76D093E4E11F5D65951EC5545BE92AF44BEA190 - SHA256 for the SQL Server 2022 KB5129300 x64 package:
07C854F949CEBA92B43BC08A726AC819545C9CBD11C2B765FF578485FE219F52
Known regression in the CU updates
KB5129299 and KB5129300 can cause an access violation and a dump file when sys.dm_exec_requests is queried while a database is recovering. The SQL Server 2022 KB names database restore, startup recovery, and an availability group replica coming online as triggering circumstances. Microsoft attributes the crash to internal structures being referenced before full initialization and is still working on a fix.
Microsoft documents two options: enable trace flag 4696 to opt out of the change that causes it, or avoid querying sys.dm_exec_requests for recovering databases. The trace flag has a caveat. Monitoring queries that use sys.dm_exec_requests or sys.sysprocesses on secondary replicas can again return error 976 or 978, as they did before the update. Both options address the regression only and do not replace the security fix. Review this before rolling out to availability groups or servers with heavy monitoring.
Detection methods
As of this writing we found no public Sigma, YARA, Snort or Suricata rules, no IoCs, and no log patterns specific to CVE-2026-116930. The only detection method that can be verified today is exposure detection: finding every SQL Server instance running a vulnerable build.
1. Build number checks
- Read each instance's product version (Microsoft's FAQ references KB 321185).
- Match the version to its branch in the affected ranges listed in the next section.
- Flag the instance if its version falls inside the affected range. The upper bound is excluded, so the fixed build itself is clean.
For example, KB5129300 moves SQL Server 2022 CU27 to product version 16.0.4315.2 (file version 2022.160.4315.2). A CU27 server reporting 16.0.4305.5 or lower is still exposed.
2. Do not rely on Windows hotfix listings
Senserva's pages for KB5129300 and KB5132745 point out that these are SQL Server application updates rather than Windows components, so they do not appear in the Windows hotfix inventory that PowerShell hotfix queries read. A script that looks for the KB number there can report a vulnerable server as clean. Compare product version to fixed build instead.
3. Patch compliance tooling
Senserva suggests checking in Intune or Defender whether the eight fixing KBs are installed. If you use Defender Vulnerability Management or a similar scanner, build a CVE-2026-116930 exposure report, then verify the reported product versions against the fixed builds rather than trusting KB presence alone. Microsoft's KB also notes that Microsoft Update detection logic for SQL Server servicing changed with this release, so recheck WSUS or Configuration Manager reporting if it has misclassified SQL updates before.
4. Hunting ideas (not vendor provided)
Given the crafted-file requirement and the command injection root cause, two broad angles may help. Treat them as general hardening ideas rather than CVE-specific signatures, and baseline them before alerting:
- Process lineage on database hosts: SQL Server or related tooling processes starting command interpreters or other unexpected child processes.
- Crafted file delivery: attacker-supplied files reaching people who administer or develop against SQL Server.
5. A post-patch crash that can look like an attack
On freshly patched SQL Server 2022 CU27 hosts, the regression described above writes EXCEPTION_ACCESS_VIOLATION entries referencing the sqlmin module to the error log, along with a stack dump. Before escalating such a dump as tampering, check whether it occurred during RESTORE, startup recovery or availability group replica onlining, and whether the input buffer shows a monitoring query.
For changes in exploitation status or new detection content, track the MSRC advisory and the CISA KEV catalog. The CVE is not in KEV as of this writing.
Affected systems and versions
Microsoft SQL Server on Windows and Linux. The NVD record, sourced from Microsoft's CNA data, gives these affected ranges (lower bound included, upper bound excluded):
- SQL Server 2025 CU10: 17.0.4006.0 up to, not including, 17.0.5045.3 (KB5129299)
- SQL Server 2025 GDR: 17.0.1050.2 up to, not including, 17.0.1155.3 (KB5132748)
- SQL Server 2022 CU27: 16.0.4003.1 up to, not including, 16.0.4315.2 (KB5129300)
- SQL Server 2022 GDR: 16.0.0 up to, not including, 16.0.1220.3 (KB5132747)
- SQL Server 2019 CU32: 15.0.4003.23 up to, not including, 15.0.4510.2 (KB5132745)
- SQL Server 2019 GDR: 15.0.0 up to, not including, 15.0.2210.4 (KB5132751)
- SQL Server 2017 CU31: 14.0.3006.16 up to, not including, 14.0.3570.2 (KB5132746)
- SQL Server 2017 GDR: 14.0.0 up to, not including, 14.0.2150.2 (KB5132749)
Some NVD lower bounds differ slightly from the MSRC applicability ranges in the Patch information section (for example 17.0.4006.0 versus 17.0.4006.2 for SQL Server 2025 CU10, and 17.0.1050.2 versus 17.0.1000.7 for SQL Server 2025 GDR). The upper bounds agree exactly with the fixed builds, and those are what matter for exposure decisions.
Vendor security history
Microsoft SQL Server ranks third in the November 2026 DB-Engines ranking, which measures popularity rather than market share or security posture. Redgate's Simple Talk places it in the same position for 2026. Historically, Microsoft's November 3, 2017 SQL Server blog reported a Gartner Leaders Quadrant placement for Operational Database Management Systems. That statement is dated and does not describe current positioning.
A relevant prior case is CVE-2024-37334 in the OLE DB Driver for SQL Server, a different vulnerability in which a malicious server could send data that compromises a connecting client. Microsoft released driver versions 18.7.4 and 19.3.5 on July 9, 2024, delivered them through Microsoft Update and standalone downloads, and included them in SQL Server 2019 and 2022 updates the same day (see KB5040936 for SQL Server 2022 GDR). That case shows SQL Server exposure can involve client components as well as the engine. It is not evidence that CVE-2026-116930 follows the same path. Together with the CU regression above, it supports relying on branch- and component-specific advisories rather than inferring safety from vendor prominence.
References
- Microsoft Security Update Guide: CVE-2026-116930
- NVD entry for CVE-2026-116930
- CVE.org record for CVE-2026-116930
- KB5129299: SQL Server 2025 CU10+GDR, November 2026 (servicing page)
- KB5129299: SQL Server 2025 CU10 security update
- KB5132748: SQL Server 2025 GDR security update
- KB5129300: SQL Server 2022 CU27 security update
- KB5129300: SQL Server 2022 CU27+GDR, November 2026 (servicing page)
- KB5132747: SQL Server 2022 GDR security update
- KB5132745: SQL Server 2019 CU32 security update
- KB5132751: SQL Server 2019 GDR security update
- KB5132746: SQL Server 2017 CU31 security update
- KB5132749: SQL Server 2017 GDR security update
- ZDI: The November 2026 Security Update Review
- Senserva: CVE-2026-116930
- Senserva: KB5129300
- Senserva: KB5132745
- VulDB: CVE-2026-116930
- MITRE CWE-77: Improper Neutralization of Special Elements used in a Command
- Microsoft Community Hub: Security hotfix released for OLE DB driver for SQL Server
- KB5040936: SQL Server 2022 GDR security update, July 9, 2024
- DB-Engines Ranking
- Simple Talk: Top Database Platforms in 2026, By the Data
- Microsoft SQL Server Blog: Leader in the ODBMS Magic Quadrant (2017)
