CVE-2026-21262

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 1.66%
EPSS Percentile: 76.84%
CISA KEV: Not listed

Description

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Mar-2026 01:18
Last Modified: 11-Jul-2026 02:32
EPSS Date: 2026-11-08
CWE: CWE-284

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Microsoft · Microsoft SQL Server 2016 Service Pack 3 (GDR) Source: CNA · [email protected]
Default status: unknown

13.0.0 ≤ version < 13.0.6480.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack Source: CNA · [email protected]
Default status: unknown

13.0.0 ≤ version < 13.0.7075.5 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2017 (CU 31) Source: CNA · [email protected]
Default status: unknown

14.0.0 ≤ version < 14.0.3520.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2017 (GDR) Source: CNA · [email protected]
Default status: unknown

14.0.0 ≤ version < 14.0.2100.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2019 (CU 32) Source: CNA · [email protected]
Default status: unknown

15.0.0.0 ≤ version < 15.0.4460.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2019 (GDR) Source: CNA · [email protected]
Default status: unknown

15.0.0 ≤ version < 15.0.2160.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2022 (GDR) Source: CNA · [email protected]
Default status: unknown

16.0.0 ≤ version < 16.0.1170.5 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2022 for x64-based Systems (CU 23) Source: CNA · [email protected]
Default status: unknown

16.0.0.0 ≤ version < 16.0.4240.4 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2025 (CU 2) Source: CNA · [email protected]
Default status: unknown

17.0.0.0 ≤ version < 17.0.4020.2 — affected (custom)

Platforms: x64-based Systems
Microsoft · Microsoft SQL Server 2025 for x64-based Systems (GDR) Source: CNA · [email protected]
Default status: unknown

17.0.1050.2 ≤ version < 17.0.1105.2 — affected (custom)

Platforms: x64-based Systems

Affected Products / Versions

microsoft / sql_server_2016 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 13.0.6300.2 · before (exclusive) 13.0.6480.4
cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*
microsoft / sql_server_2016 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 13.0.7000.253 · before (exclusive) 13.0.7075.5
cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:x64:*
microsoft / sql_server_2017 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 14.0.1000.169 · before (exclusive) 14.0.2100.4
cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*
microsoft / sql_server_2017 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 14.0.3006.16 · before (exclusive) 14.0.3520.4
cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:x64:*
microsoft / sql_server_2019 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.0.2000.5 · before (exclusive) 15.0.2160.4
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*
microsoft / sql_server_2019 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 15.0.4003.23 · before (exclusive) 15.0.4460.4
cpe:2.3:a:microsoft:sql_server_2019:*:*:*:*:*:*:x64:*
microsoft / sql_server_2022 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 16.0.1000.6 · before (exclusive) 16.0.1170.5
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*
microsoft / sql_server_2022 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 16.0.4003.1 · before (exclusive) 16.0.4240.4
cpe:2.3:a:microsoft:sql_server_2022:*:*:*:*:*:*:x64:*
microsoft / sql_server_2025 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 17.0.1000.7 · before (exclusive) 17.0.1105.2
cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*
microsoft / sql_server_2025 Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 17.0.4006.2 · before (exclusive) 17.0.4020.2
cpe:2.3:a:microsoft:sql_server_2025:*:*:*:*:*:*:x64:*

References

[email protected]

Last enrichment sync: 09-Nov-2026 14:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

in its May 2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated Important addressing many privilege escalation Microsoft Patches 84 Vulnerabilities in May 2026 Update, Including Two Publicly Disclosed Zero-Days
Notable fixes include CVE-2026-21262 (SQL Server privilege escalation) and CVE-2026-26144 (Excel Copilot zero-click information disclosure), and administrators are urged to apply updates immediately to mitigate remote Microsoft’s March 2026 Patch Tuesday Fixes 79 Vulnerabilities, Including Two Disclosed Zero-Days
Two publicly disclosed zero-days were patched: CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET. Microsoft’s March 2026 Patch Tuesday Fixes 79 Flaws, Including Two Publicly Disclosed Zero-Days
These include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server. Microsoft Patches 83 Vulnerabilities in March 2026 Update

CVE (14)

People (6)

MITRE ATT&CK (2)

Vendors (7)

Products (25)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.