CVE-2026-26115: high-severity vulnerability in Microsoft SQL Server 2016 Service Pack 3 Azure…
SQL Server Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
SQL Server fails to properly validate certain user inputs, allowing someone with legitimate access to gain higher privileges on the system over a network. This means an authorized user could become an administrator without permission.
An authenticated attacker can exploit improper input validation in SQL Server to escalate privileges over the network. The vulnerability requires valid credentials but allows lateral privilege elevation, potentially leading to full administrative control of the SQL Server instance.
In the same product, most dangerous first.