The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper neutralization of special elements used in a command ('command injection') in SQL Server allows     an unauthorized attacker to execute code over a network. (CVE-2026-116930)

  - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
    (CVE-2026-116945, CVE-2026-118106)

  - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
    (CVE-2026-116931, CVE-2026-116933, CVE-2026-116937, CVE-2026-116938, CVE-2026-116941, CVE-2026-116942,     CVE-2026-116946, CVE-2026-116947, CVE-2026-67372, CVE-2026-67374, CVE-2026-67391, CVE-2026-67632,     CVE-2026-67637, CVE-2026-67646, CVE-2026-88111, CVE-2026-94511)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
380362	Security Updates for Microsoft SQL Server (November 2026)	Nessus	Windows : Microsoft Bulletins	11/13/2026	11/13/2026	high
380361	Security Updates for Microsoft SQL Server (November 2026)	Nessus	Misc.	11/13/2026	11/13/2026	high

Detections

Analytics

Plugins Search

high

high