Brief Summary: CVE-2026-116934 in Microsoft SQL Server, an Untrusted Pointer Dereference Enabling Privilege Escalation

Introduction

Microsoft's November 10, 2026 SQL Server security updates close an elevation of privilege flaw that lets an authenticated database user turn a specially crafted network request into elevated privileges in the SQL Server service context. The fix spans SQL Server 2017, 2019, 2022 and 2025 across separate GDR and cumulative update tracks. For most teams the practical work is matching each instance to the correct package and watching for a documented recovery regression that ships in some of the same updates.

Technical information

Root cause: CWE 822, Untrusted Pointer Dereference

Microsoft classifies CVE-2026-116934 as CWE 822, Untrusted Pointer Dereference. MITRE defines this weakness as converting an untrusted value into a pointer and then dereferencing the resulting pointer. In practice, the database engine takes a value that an attacker can influence and uses it as a memory address without first checking it.

That explains the weakness class, but not the specific code path. SQL Server is closed source, there is no public commit or diff, and Microsoft has not identified the affected function, component or request field. The fix exists only as compiled binaries in the new SQL Server builds.

The disclosed attack scenario

The MSRC FAQ is specific about prerequisites and outcome, even though it is silent on internals. Based on that description, the attack flow is:

1. The attacker already holds authenticated access to the SQL Server instance, with permission to execute the affected database operation. Microsoft does not name the operation or the exact permission.
2. The attacker sends a specially crafted request to the instance over the network.
3. Inside the engine, an attacker-influenced value is used as a pointer without adequate validation (the CWE 822 condition).
4. Successful exploitation grants elevated privileges in the SQL Server service context. No other user needs to take any action.

The public material also sets some limits on how far this goes:

• Exploitation requires an authenticated session, so this is a privilege escalation path rather than an authentication bypass.
• The advisory describes privileges in the SQL Server service context. It does not say the resulting account is Windows SYSTEM.
• Nothing in the public material indicates a SQL injection mechanism, and no request layout, SQL statement or payload has been published.

CVSS breakdown

Microsoft's CNA assessment is a base score of 8.8 (High):

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack vector: Network (exploitable over the network)
• Attack complexity: Low
• Privileges required: Low (the attacker already has limited privileges)
• User interaction: None
• Scope: Unchanged
• Confidentiality, integrity and availability: High potential impact for each

Microsoft also publishes a 7.7 temporal score, with the extended vector ending in:

E:U/RL:O/RC:C

That is exploit maturity Unproven, remediation level Official Fix, and report confidence Confirmed. NVD currently lists the record as Awaiting Enrichment and has not supplied its own assessment, so the 8.8 figure is Microsoft's. Microsoft separately rates the issue Important in its product severity system. The High CVSS label and the Important rating come from different rating systems and do not contradict each other.

Generic weakness consequences versus confirmed impact

MITRE lists possible CWE 822 consequences such as sensitive data reads, crashes, state modification and code execution, depending on how the pointer is used. Those are generic consequences of the weakness class. For this CVE, Microsoft's confirmed classification is elevation of privilege, and we would not extend the impact statement beyond that without further vendor detail.

Patch information

Microsoft fixed CVE-2026-116934 in its November 10, 2026 SQL Server security updates, with a Remediation Level of Official Fix. A fix for this class of bug generally makes the engine validate the pointer, or derive it from trusted internal state, before using it. Microsoft has not said which code path changed. The fix tables in the KB articles list many hardening items, mostly around replication, access methods, transaction logging and XML. None of them is mapped to this CVE, so no single bug reference entry should be treated as the fix.

Fixed builds by servicing branch

SQL Server has two update tracks. GDR updates carry only security and critical fixes. CU+GDR updates add the security fix on top of a specific Cumulative Update level. Pick the entry whose build range contains your current build:

The advisory's Security Updates download table and NVD's affected products list show only seven entries, and both leave out SQL Server 2017 RTM+GDR. The MSRC FAQ table does include KB5132749, and the KB5132749 article itself lists CVE-2026-116934 as resolved. If you run the 2017 GDR track, use KB5132749.

Choose by servicing branch rather than by the highest build number. A CU+GDR build is not interchangeable with a GDR build for the same release.

One package, many CVEs

KB5129300 (SQL Server 2022 CU27), for example, lists CVE-2026-116934 alongside about 30 other SQL Server CVEs from the same month, covering elevation of privilege, information disclosure and remote code execution. KB5129300 moves the engine to product version 16.0.4315.2 (file version 2022.160.4315.2), applies to both Windows and Linux, and is available through Windows Update, the Microsoft Update Catalog or the Download Center. On Linux, install it from the configured CU package repository. The KB5129299 Download Center package for SQL Server 2025 applies to instances with a cumulative update already installed and notes that a restart may be required.

Known regression to watch for

KB5129300 documents a known issue: querying sys.dm_exec_requests while a database is still recovering can cause an access violation and a stack dump, because internal in-memory structures are referenced before they are fully set up. KB5129299 for SQL Server 2025 documents the same class of issue during database recovery, and the 2022 article describes it occurring during RESTORE, startup recovery, or before an availability group replica finishes coming online. Microsoft says it is investigating a fix. Its listed options are:

• Enable trace flag 4696 to opt out of the code change.
• Avoid querying that DMV against recovering databases.
• Uninstall the update.

These options address the recovery regression only. They are not mitigations for CVE-2026-116934, and Microsoft offers no separate CVE-specific workaround, so the security update itself remains the remediation. Read this section of the KB before deploying to monitored production servers, since monitoring tools that poll sys.dm_exec_requests are the obvious trigger.

According to ZDI's November 2026 review, the bug was rated Important (CVSS 8.8) and was neither publicly known nor exploited when the patch shipped. Microsoft's advisory likewise records Exploited: No, Publicly disclosed: No, Exploitation Less Likely, and exploit code maturity Unproven. CVE-2026-116934 was not present in the reviewed CISA KEV catalog snapshot (version 2026.11.10, 1,779 entries), and no threat actor or campaign is associated with it in the reviewed sources.

Affected systems and versions

The CVE Program record lists the following affected intervals for x64 builds. The lower bound is included and the fixed build is excluded.

• SQL Server 2017 CU31: from 14.0.3006.16, before 14.0.3570.2
• SQL Server 2019 GDR: from 15.0.0, before 15.0.2210.4
• SQL Server 2019 CU32: from 15.0.4003.23, before 15.0.4510.2
• SQL Server 2022 GDR: from 16.0.0, before 16.0.1220.3
• SQL Server 2022 CU27: from 16.0.4003.1, before 16.0.4315.2
• SQL Server 2025 CU10: from 17.0.4006.0, before 17.0.5045.3
• SQL Server 2025 GDR: from 17.0.1050.2, before 17.0.1155.3

SQL Server 2017 RTM+GDR builds 14.0.1000.169 through 14.0.2140.2 are also covered by KB5132749, per the MSRC FAQ and the KB5132749 article, even though this branch is missing from the CVE record intervals and from NVD.

The vulnerable configuration is any of these builds where an attacker holds authenticated access with permission to execute the affected database operation and can reach the instance over the network. The reviewed KB articles cover SQL Server 2025, 2022 and 2019 on both Windows and Linux. If your installed version is not represented, Microsoft directs customers to review update prerequisites and release support status before selecting an update.

Vendor security history

Microsoft is both the affected vendor and the CNA. SQL Server ranks third in the November 2026 DB Engines popularity ranking with a score of 693.53. That supports describing it as a prominent database platform, though the score is not a market share percentage.

The most significant independent assessment of Microsoft's broader security record is the Cyber Safety Review Board report on the summer 2023 Exchange Online intrusion. The Board found that the actor compromised mailboxes belonging to 22 organizations and more than 500 individuals using authentication tokens signed with a Microsoft key created in 2016. It called the intrusion preventable, concluded that Microsoft's security culture was inadequate and required an overhaul, and identified a cascade of avoidable errors, including failure to independently detect the key compromise. That incident has no connection to SQL Server or to this CVE.

On the response side, Microsoft's July 2026 Secure Future Initiative report describes broader Zero Trust enforcement for source code access, 93% of critical and high-value build pipelines using centrally governed templates, remediation of more than 550,000 instances of critical and high-risk open source vulnerabilities, and automated container patching addressing about 3 million vulnerability instances per month. These vendor-reported figures describe development and supply chain processes and say nothing about this specific pointer defect. For CVE-2026-116934, the actionable vendor evidence is the affected product matrix, the official fixed builds and the release-specific operational guidance.

References

• NVD entry for CVE-2026-116934
• CVE Record for CVE-2026-116934
• Microsoft Security Update Guide: CVE-2026-116934, Microsoft SQL Server Elevation of Privilege Vulnerability
• KB5129300: Security update for SQL Server 2022 CU27, November 10, 2026
• KB5132749: Security update for SQL Server 2017 GDR
• KB5129299: Security update for SQL Server 2025 CU10, November 10, 2026
• KB5132751: Security update for SQL Server 2019 GDR, November 10, 2026
• ZDI: The November 2026 Security Update Review
• Download Center: SQL Server 2025 RTM CU10 (KB5129299)
• Download Center: SQL Server 2025 RTM (KB5132748)
• Download Center: SQL Server 2022 RTM CU27 (KB5129300)
• Download Center: SQL Server 2022 RTM (KB5132747)
• Download Center: SQL Server 2019 RTM CU32 (KB5132745)
• Download Center: SQL Server 2019 RTM (KB5132751)
• Download Center: SQL Server 2017 RTM CU31 (KB5132746)
• Microsoft Learn: Latest updates and version history for SQL Server
• MITRE CWE 822: Untrusted Pointer Dereference
• CISA Known Exploited Vulnerabilities catalog feed
• CISA: Cyber Safety Review Board report on the Summer 2023 Microsoft Exchange Online incident
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion (PDF)
• Microsoft Secure Future Initiative progress report, July 2026
• DB Engines Ranking
• Microsoft SQL Server product page
• cve.now: CVE-2026-116934
• Senserva: CVE-2026-116934
• VulDB: CVE-2026-116934 in SQL Server