The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Improper neutralization of special elements used in a command ('command injection') in SQL Server allows     an unauthorized attacker to execute code over a network. (CVE-2026-116930)

  - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
    (CVE-2026-116945, CVE-2026-118106)

  - Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
    (CVE-2026-116931, CVE-2026-116933, CVE-2026-116937, CVE-2026-116938, CVE-2026-116941, CVE-2026-116942,     CVE-2026-116946, CVE-2026-116947, CVE-2026-67372, CVE-2026-67374, CVE-2026-67391, CVE-2026-67632,     CVE-2026-67637, CVE-2026-67646, CVE-2026-88111, CVE-2026-94511)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
380361	Security Updates for Microsoft SQL Server (November 2026)	Nessus	Misc.	2026/11/13	2026/11/13	high
380362	Security Updates for Microsoft SQL Server (November 2026)	Nessus	Windows : Microsoft Bulletins	2026/11/13	2026/11/13	high

检测

插件搜索

high

high