Action Recommended: On-premise Q360 customers should update their SQL Server using the applicable November 2026 security update. Customers on Q360 SaaS are not required to take any action; this patch is scheduled for deployment on November 11, 2026.
What is changing
Microsoft released a security update on November 10, 2026 addressing CVE-2026-116945, a critical remote code execution vulnerability in Microsoft SQL Server (CVSS 3.1 base score 9.8). The vulnerability is a heap-based buffer overflow that could allow an unauthorized attacker to execute code over a network. At the time of release, Microsoft reported that the vulnerability had not been publicly disclosed or exploited. Full details, including affected versions and security updates, are available in the Microsoft Security Response Center advisory.
Who is affected
Action is required for on-premise Q360 customers only running SQL Server 2017, SQL Server 2019, SQL Server 2022, or SQL Server 2025. Customers on Q360 SaaS are not required to take any action. Solutions360 has scheduled this patch for deployment to all SaaS environments for early AM on November 11, 2026.
Please note: this is not a vulnerability in the Q360 application. SQL Server is a third-party database component in your on-premise Q360 environment — typically maintained by your IT team or hosting provider.
What you need to do
Update your SQL Server using the applicable November 2026 security update:
- Determine your current SQL Server version number. For instructions, see How to determine the version, edition, and update level of SQL Server and its components.
- Find the range that contains your current version number in the table below, and install the matching security update.
- Schedule the update outside business hours — Microsoft indicates a restart is required, and Q360 will be unavailable while SQL Server restarts.
- If you would have questions or require assistance, contact support@solutions360.com to open a service call.
Reference
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116945 | Microsoft SQL Server Remote Code Execution Vulnerability | 10 Nov 2026
- https://www.cve.org/CVERecord?id=CVE-2026-116945 | CVE-2026-116945 | 10 Nov 2026
[/vc_column_text][/vc_column][/vc_row]