cbcvebase.
CVE-2026-21262
published 2026-03-10

CVE-2026-21262: Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

PriorityP184high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.04%
79.0th percentile
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftmicrosoft_sql_server_2016_service_pack_3>= 13.0.0 < 13.0.6480.413.0.6480.4
microsoftmicrosoft_sql_server_2016_service_pack_3_azure_connect_feature_pack>= 13.0.0 < 13.0.7075.513.0.7075.5
microsoftmicrosoft_sql_server_2017>= 14.0.0 < 14.0.3520.414.0.3520.4
microsoftmicrosoft_sql_server_2017>= 14.0.0 < 14.0.2100.414.0.2100.4
microsoftmicrosoft_sql_server_2019>= 15.0.0 < 15.0.2160.415.0.2160.4
microsoftmicrosoft_sql_server_2019>= 15.0.0.0 < 15.0.4460.415.0.4460.4
microsoftmicrosoft_sql_server_2022>= 16.0.0 < 16.0.1170.516.0.1170.5
microsoftmicrosoft_sql_server_2022_for_x64-based_systems>= 16.0.0.0 < 16.0.4240.416.0.4240.4
microsoftmicrosoft_sql_server_2025>= 17.0.0.0 < 17.0.4020.217.0.4020.2
microsoftmicrosoft_sql_server_2025_for_x64-based_systems>= 17.0.1050.2 < 17.0.1105.217.0.1105.2
microsoftsql_server_2016>= 13.0.6300.2 < 13.0.6480.413.0.6480.4
microsoftsql_server_2016>= 13.0.7000.253 < 13.0.7075.513.0.7075.5
microsoftsql_server_2017>= 14.0.1000.169 < 14.0.2100.414.0.2100.4
microsoftsql_server_2017>= 14.0.3006.16 < 14.0.3520.414.0.3520.4
microsoftsql_server_2019>= 15.0.2000.5 < 15.0.2160.415.0.2160.4
microsoftsql_server_2019>= 15.0.4003.23 < 15.0.4460.415.0.4460.4
microsoftsql_server_2022>= 16.0.1000.6 < 16.0.1170.516.0.1170.5
microsoftsql_server_2022>= 16.0.4003.1 < 16.0.4240.416.0.4240.4
microsoftsql_server_2025>= 17.0.1000.7 < 17.0.1105.217.0.1105.2
microsoftsql_server_2025>= 17.0.4006.2 < 17.0.4020.217.0.4020.2
msrcmicrosoft_sql_server_2016_for_x64-based_systems_service_pack_3
msrcmicrosoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea
msrcmicrosoft_sql_server_2017_for_x64-based_systems
msrcmicrosoft_sql_server_2019_for_x64-based_systems
msrcmicrosoft_sql_server_2022_for_x64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

  • Target privilege: attacker elevates to SQL Server sysadmin role over the network; monitor for unexpected sysadmin role grants to low-privileged SQL logins
  • Post-exploitation indicator: monitor for xp_cmdshell being enabled by non-administrative accounts, as sysadmin access allows enabling it in seconds to execute OS-level commands
  • Scope: all SQL Server versions from 2016 SP3 through 2025 are affected; audit exposed instances and prioritize patching across this entire range
  • Exploitation method: an authenticated attacker with explicit permissions logs in to SQL Server and exploits the improper access control to elevate to sysadmin; monitor for privilege escalation events from accounts with only explicit (non-sysadmin) permissions
  • Vulnerability is publicly disclosed (zero-day at patch time) with no confirmed in-the-wild exploitation yet; treat as high-urgency given public disclosure status
  • ·xp_cmdshell is disabled by default but can be re-enabled instantly by any sysadmin; verify this setting is disabled and audit who holds sysadmin role as a compensating control
  • ·SQL Server instances on Windows Azure (IaaS) require manual patching via Microsoft Update or manual download — they are not automatically patched
  • ·Switching from GDR to CU update path is a one-way, irreversible change; choose the correct update track before applying patches

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.