CVE-2026-21262

Published: Mar 10, 2026Modified: Jul 10, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Affected (10)

Products: Microsoft: Sql Server 2016, Sql Server 2017, Sql Server 2019, Sql Server 2022, Sql Server 2025

5 products

Sql Server 2016

Sql Server 2017

Sql Server 2019

Sql Server 2022

Sql Server 2025

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sql Server 2016	From 13.0.6300.2 to 13.0.6480.4
Microsoft Sql Server 2016	From 13.0.7000.253 to 13.0.7075.5
Microsoft Sql Server 2017	From 14.0.1000.169 to 14.0.2100.4
Microsoft Sql Server 2017	From 14.0.3006.16 to 14.0.3520.4
Microsoft Sql Server 2019	From 15.0.2000.5 to 15.0.2160.4
Microsoft Sql Server 2019	From 15.0.4003.23 to 15.0.4460.4
Microsoft Sql Server 2022	From 16.0.1000.6 to 16.0.1170.5
Microsoft Sql Server 2022	From 16.0.4003.1 to 16.0.4240.4
Microsoft Sql Server 2025	From 17.0.1000.7 to 17.0.1105.2
Microsoft Sql Server 2025	From 17.0.4006.2 to 17.0.4020.2

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.