Microsoft

CVE-2026-21262: SQL Server Elevation of Privilege Vulnerability

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 13 Apr 2026. It cites 1 public report, the first from 13 Apr 2026.

recordedfuture.com

How likely is exploitation in the next 30 days?

2.1%

EPSS score, percentile 81.9 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

8.8 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

from 13.0.0 to before 13.0.6480.4
from 13.0.0 to before 13.0.7075.5
from 14.0.0 to before 14.0.3520.4
from 14.0.0 to before 14.0.2100.4
from 15.0.0.0 to before 15.0.4460.4
from 15.0.0 to before 15.0.2160.4

and 4 more in the table below

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

SQL Server Elevation of Privilege Vulnerability (Vendor advisory, Patch)

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (10 products)

Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR)
Status	Versions
Affected	from 13.0.0 to before 13.0.6480.4

Microsoft Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
Status	Versions
Affected	from 13.0.0 to before 13.0.7075.5

Microsoft Microsoft SQL Server 2017 (CU 31)
Status	Versions
Affected	from 14.0.0 to before 14.0.3520.4

Microsoft Microsoft SQL Server 2017 (GDR)
Status	Versions
Affected	from 14.0.0 to before 14.0.2100.4

Microsoft Microsoft SQL Server 2019 (CU 32)
Status	Versions
Affected	from 15.0.0.0 to before 15.0.4460.4

Microsoft Microsoft SQL Server 2019 (GDR)
Status	Versions
Affected	from 15.0.0 to before 15.0.2160.4

Microsoft Microsoft SQL Server 2022 (GDR)
Status	Versions
Affected	from 16.0.0 to before 16.0.1170.5

Microsoft Microsoft SQL Server 2022 for x64-based Systems (CU 23)
Status	Versions
Affected	from 16.0.0.0 to before 16.0.4240.4

Microsoft Microsoft SQL Server 2025 (CU 2)
Status	Versions
Affected	from 17.0.0.0 to before 17.0.4020.2

Microsoft Microsoft SQL Server 2025 for x64-based Systems (GDR)
Status	Versions
Affected	from 17.0.1050.2 to before 17.0.1105.2

Source: CVE List, as of 30 Oct 2026. About the data.

Weakness

CWE-284

CWE-284: Improper Access Control

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

Date	Event
10 Mar 2026	CVE record published
19 Jun 2026	CVE record last updated

Known exploited Microsoft vulnerabilities

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability (added 13 Oct 2026)
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability (added 25 Sep 2026)
CVE-2026-81963: Microsoft Windows Link Following Vulnerability (added 8 Sep 2026)
CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability (added 8 Sep 2026)
CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability (added 26 Aug 2026)