CVE-2026-21262: 
vulnerability analysis and mitigation

CVE-2026-21262 is a privilege escalation vulnerability in Microsoft SQL Server caused by improper access control (CWE-284), allowing an authenticated attacker with low-level privileges to elevate to full sysadmin control over the network without user interaction. Disclosed and patched on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday, it affects SQL Server 2016, 2017, 2019, 2022, and 2025 across multiple cumulative update and GDR branches. It carries a CVSS v3.1 base score of 8.8 (High) (Microsoft MSRC, Feedly).

The root cause is improper access control (CWE-284) within the SQL Server engine, which fails to adequately enforce privilege boundaries for authenticated network users. An attacker with a low-privileged SQL Server account can exploit this flaw over the network (attack vector: Network, attack complexity: Low, privileges required: Low, user interaction: None) to escalate to sysadmin-level privileges. Feedly's CWE estimate also flags a potential use-after-free (CWE-416) component, though Microsoft's official classification is CWE-284. No public proof-of-concept exploit code has been confirmed, but exploitation has been reported in the wild (Microsoft MSRC, Tenable Blog, undercodetesting.com).

Successful exploitation grants an attacker complete sysadmin control over the affected SQL Server instance, enabling full read, write, and deletion of all hosted databases. This can result in mass data exfiltration, destruction of critical business data, and potential lateral movement within the broader network infrastructure by leveraging the SQL Server's trusted position and linked server configurations. All SQL Server versions from 2016 through 2025 are in scope, making the blast radius significant for enterprise environments (Microsoft MSRC, Feedly).

1. Reconnaissance: Identify internet-facing or internally accessible Microsoft SQL Server instances (versions 2016–2025) using network scanners, Shodan, or internal asset inventories. Confirm version numbers to determine if they fall within vulnerable ranges.
2. Obtain low-privileged credentials: Acquire a valid SQL Server login with minimal permissions (e.g., public role) via credential stuffing, phishing, or reuse of compromised credentials from other services.
3. Connect to the SQL Server: Establish a connection to the target SQL Server instance using a standard SQL client (e.g., sqlcmd, SSMS, or a custom script) over TCP port 1433 (default).
4. Trigger the privilege escalation: Exploit the improper access control flaw by sending a crafted request or executing specific SQL commands that abuse the vulnerable access control logic, causing the server to grant sysadmin-level privileges to the low-privileged session. The exact technique is not publicly documented, but the vulnerability is network-exploitable without user interaction.
5. Achieve sysadmin control: With elevated privileges, execute commands such as EXEC xp_cmdshell to run OS-level commands, exfiltrate data, create backdoor accounts, or pivot to other systems via linked servers (Microsoft MSRC, undercodetesting.com).

• Network: Unexpected inbound connections to TCP port 1433 from unusual source IPs or at unusual times; outbound connections from the SQL Server host to external IPs following privilege escalation.
• Logs: SQL Server error logs or audit logs showing a low-privileged account suddenly executing sysadmin-level operations (e.g., sp_addsrvrolemember, xp_cmdshell, RECONFIGURE); Windows Event Logs showing new SQL Server logins followed by privilege changes.
• Process: Unusual child processes spawned by sqlservr.exe (e.g., cmd.exe, powershell.exe, net.exe); execution of xp_cmdshell by accounts not previously authorized to use it.
• File System: New or modified SQL Server agent jobs; unexpected files written to SQL Server data directories or temp folders by the SQL Server service account.
• Database: New sysadmin-role members added to SQL Server; unexpected stored procedures or linked server configurations created (socprime.com, Feedly).

Microsoft released patches on March 10, 2026 as part of Patch Tuesday. Administrators should apply the following fixed versions immediately:

• SQL Server 2016 SP3 GDR: upgrade to 13.0.6480.4 or later
• SQL Server 2016 SP3 Azure Connect Feature Pack: upgrade to 13.0.7075.5 or later
• SQL Server 2017 GDR: upgrade to 14.0.2100.4 or later
• SQL Server 2017 CU31: upgrade to 14.0.3520.4 or later
• SQL Server 2019 GDR: upgrade to 15.0.2160.4 or later
• SQL Server 2019 CU32: upgrade to 15.0.4460.4 or later
• SQL Server 2022 GDR: upgrade to 16.0.1170.5 or later
• SQL Server 2022 CU: upgrade to 16.0.4240.4 or later
• SQL Server 2025: upgrade to 17.0.1105.2 or 17.0.4020.2 or later

As a temporary mitigation, restrict network access to SQL Server instances to trusted hosts only, enforce the principle of least privilege for all SQL logins, and monitor for anomalous privilege escalation activity. Amazon RDS has also released updated support for the patched CU/GDR versions (Microsoft MSRC, AWS).

The vulnerability received broad coverage across the security community as part of the March 2026 Patch Tuesday cycle, with researchers from Tenable, Rapid7, Qualys, Sophos, Cisco Talos, and Zero Day Initiative all publishing analyses (Tenable Blog, Rapid7, ZDI). KrebsOnSecurity and BleepingComputer highlighted it as one of the most critical issues in the March update, and Computer Weekly specifically noted it as a zero-day in SQL Server (KrebsOnSecurity, Computer Weekly). Reddit communities (r/SQL, r/SQLServer, r/SecOpsDaily) actively discussed the vulnerability and its implications for database administrators. Recorded Future's March 2026 CVE landscape report identified it as one of 31 high-impact vulnerabilities for the month (Recorded Future).