As part of Microsoft’s March 2026 Security Update, an elevation of privilege vulnerability in Microsoft SQL Server, tracked as CVE-2026-21262, was disclosed and patched. The flaw arises from improper access control within SQL Server that allows an authenticated, low-privileged user to escalate their rights over the network to the highest built-in role on the database instance. According to the National Vulnerability Database (NVD), the issue has a CVSS v3.1 base score of 8.8 (High), reflecting the potential for complete compromise of affected SQL Server instances when exploited by an attacker with valid credentials.

The vulnerability affects supported releases of SQL Server and Microsoft has released security updates for SQL Server 2016, SQL Server 2017, SQL Server 2019, SQL Server 2022 and SQL Server 2025, across both cumulative update (CU) and General Distribution Release (GDR) servicing tracks. Organisations running these platforms should assume they are affected unless they have already applied the March 2026 security updates documented in the Microsoft Security Response Center (MSRC) advisory for CVE-2026-21262.

Further authoritative information is available from the MSRC advisory for CVE-2026-21262 and the NVD entry for CVE-2026-21262.

What is CVE-2026-21262?

CVE-2026-21262 is described by Microsoft as an elevation of privilege vulnerability caused by improper access control in SQL Server. In practice, this means that certain internal permission checks do not correctly enforce role boundaries when specific database operations are invoked. An attacker who has authenticated access to the database engine with low privileges can exploit this logic flaw to execute actions that should be restricted to high-privileged roles.

Public reporting indicates that exploitation requires only network-level connectivity to an affected SQL Server instance and a valid SQL login with limited privileges. From there, an attacker can craft requests that abuse the flawed authorisation checks to elevate their effective role, ultimately achieving permissions equivalent to the sysadmin role. The sysadmin role grants unconstrained control over the SQL Server instance, including the ability to access and modify all user databases, configure linked servers, change authentication settings and run operating system commands via extended stored procedures.

Importantly, the vulnerability does not provide initial access by itself. It cannot be exploited anonymously or without credentials; an attacker must first authenticate to the SQL Server instance. However, in many environments database credentials are widely distributed across applications, integration platforms and administrative tooling, which increases the likelihood that a determined adversary can obtain a suitable low privilege account to target.

What is the impact of the vulnerability?

From a technical perspective, successful exploitation of CVE-2026-21262 results in full compromise of the affected SQL Server instance. Once an attacker has obtained sysadmin-level privileges, they can read, modify or delete any data stored in user and system databases, create new logins, alter existing permissions and deploy malicious objects such as triggers or stored procedures to maintain persistence.

In environments where SQL Server is configured to allow interaction with the underlying operating system, elevated database privileges can also be leveraged to execute commands on the host. This can enable lateral movement, installation of additional tooling and further compromise of connected systems. Even where direct OS command execution is restricted, control over business-critical data stores can be sufficient for a malicious actor to extort an organisation, disrupt operations or manipulate records for financial gain.

At the business level, affected organisations face risks to confidentiality, integrity and availability. Sensitive data stored in SQL Server databases, including personal data, financial records and operational telemetry, may be exposed or altered without detection. Service availability can be impacted if attackers choose to drop databases, modify configuration or interfere with backup and recovery processes. For organisations subject to regulatory frameworks such as the UK GDPR, PCI DSS or sector-specific regulators, a compromise of SQL Server hosting regulated data could trigger breach notification obligations, supervisory investigation and potential enforcement action.

How to fix CVE-2026-21262

Microsoft recommends that all customers apply the security updates associated with CVE-2026-21262 as a priority. The primary remediation is to install the latest supported cumulative update or GDR package for your SQL Server version, as outlined in the MSRC advisory and related Knowledge Base (KB) articles. At the time of writing, these include at least the following:

Where immediate patching is operationally challenging, organisations should implement compensating controls to reduce exposure. These include enforcing least privilege for all SQL logins, reviewing application accounts to ensure they do not hold unnecessary elevated rights, restricting network access to SQL Server instances using firewalls and network security groups, and monitoring for unusual permission changes or role assignments within the database environment.

Because exploitation requires valid credentials, broader identity and access management controls are also relevant. Enforcing multi-factor authentication for administrative access paths, rotating shared or embedded database credentials, and improving secrets management for application connection strings can all reduce the likelihood that an attacker can obtain a foothold account to escalate.

How can Sentrium help?

CVE-2026-21262 highlights how quickly a single logic flaw in a core data platform can translate into organisation wide risk. Many organisations operate complex SQL Server estates spanning on-premises and cloud deployments, legacy versions and third-party applications, which can make risk assessment and remediation challenging.

Sentrium can support organisations by independently validating that SQL Server instances have been correctly patched, assessing database configuration and permission models, and identifying exposure paths that could be used to exploit similar elevation of privilege issues. Through targeted penetration testing and configuration reviews, we help teams understand how vulnerabilities in data platforms translate into real-world attack paths across their environment.

If you would like to discuss how this vulnerability affects your environment, or how to strengthen the security of your SQL Server and wider data estate, the Sentrium team would be happy to talk through practical options and next steps.