CVE-2026-26116
Published: 10 March 2026
Summary
CVE-2026-26116 is a high-severity SQL Injection (CWE-89) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 36.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26116 is a SQL injection vulnerability (CWE-89) in Microsoft SQL Server, caused by improper neutralization of special elements used in an SQL command. This flaw affects the SQL Server component and has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation allows the attacker to elevate privileges, potentially leading to high impacts on confidentiality, integrity, and availability within the affected SQL Server instance.
The Microsoft Security Response Center has published an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26116, which provides details on patches and recommended mitigations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10686
Vulnerability details
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection (CWE-89) in Microsoft SQL Server directly enables privilege escalation from a low-privileged authenticated account (PR:L) to high-impact access, matching T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection exploitation by requiring validation and neutralization of special elements in inputs to SQL commands.
Mitigates the specific SQL injection flaw in SQL Server through timely identification, reporting, and patching as recommended by MSRC.
Limits damage from privilege escalation by ensuring only minimal privileges are granted, reducing the impact of successful exploitation.