CVE-2026-21262: Microsoft SQL Server Elevation of Privilege via Improper Access Control in Merge Replication

Key facts

Detection coverage

As of 2026-03-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0216 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-21262 Post-Exploitation — Backdoor Account and Persistence

Detects post-exploitation activity following CVE-2026-21262 privilege escalation: creation of new SQL logins, sysadmin role assignment via sp_addsrvrolemember or ALTER SERVER ROLE, and stored procedure persistence via sp_procoption startup registration. These actions indicate an attacker consolidating sysadmin access with backdoor accounts and persistent code execution.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1098, T1136.001, T1505.001
• Data sources: mssql_audit, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

index=mssql sourcetype="MSSQL:Audit:Event" OR sourcetype="MSSQL:Error"
(statement="*CREATE LOGIN*" OR statement="*sp_addsrvrolemember*" OR statement="*ALTER SERVER ROLE*sysadmin*ADD MEMBER*" OR statement="*sp_procoption*startup*" OR statement="*CREATE PROCEDURE*")
| eval post_exploit_action=case(
    match(statement, "(?i)CREATE\s+LOGIN"), "backdoor_login_created",
    match(statement, "(?i)sp_addsrvrolemember|ALTER\s+SERVER\s+ROLE.*sysadmin.*ADD\s+MEMBER"), "sysadmin_role_granted",
    match(statement, "(?i)sp_procoption.*startup"), "startup_procedure_registered",
    match(statement, "(?i)CREATE\s+PROCEDURE"), "stored_procedure_created",
    1=1, "unknown")
| stats count values(post_exploit_action) as actions values(statement) as statements min(_time) as first_seen max(_time) as last_seen by host, login_name, database_name, client_ip
| where mvcount(actions) >= 2
| sort -last_seen

Microsoft KQL

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SQL" or Category == "SQLSecurityAuditEvents"
| where TimeGenerated > ago(24h)
| where statement_s has_any ("CREATE LOGIN", "sp_addsrvrolemember", "ALTER SERVER ROLE", "sp_procoption", "CREATE PROCEDURE")
| extend PostExploitAction = case(
    statement_s has "CREATE LOGIN", "backdoor_login_created",
    statement_s has_any ("sp_addsrvrolemember", "ALTER SERVER ROLE"), "sysadmin_role_granted",
    statement_s has "sp_procoption", "startup_procedure_registered",
    statement_s has "CREATE PROCEDURE", "stored_procedure_created",
    "unknown")
| summarize ActionCount=dcount(PostExploitAction), Actions=make_set(PostExploitAction), Statements=make_set(statement_s), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by server_principal_name_s, host_s, database_name_s, client_ip_s
| where ActionCount >= 2
| sort by LastSeen desc

Sigma

title: CVE-2026-21262 Post-Exploitation — Backdoor Account and Persistence
id: a8b2c3d4-e5f6-4a78-9012-bcdef1234567
status: experimental
description: Detects post-exploitation persistence after CVE-2026-21262 privilege escalation including backdoor SQL login creation, sysadmin role assignment, and stored procedure startup persistence
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262
    - https://intel.threadlinqs.com/threats/TL-2026-0216
author: Threadlinqs Team
date: 2026/03/12
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1136.001
    - attack.t1505.001
    - cve.2026.21262
logsource:
    product: mssql
    service: application
detection:
    selection_create_login:
        CommandText|contains:
            - 'CREATE LOGIN'
    selection_sysadmin_grant:
        CommandText|contains:
            - 'sp_addsrvrolemember'
            - 'ALTER SERVER ROLE sysadmin ADD MEMBER'
    selection_startup_proc:
        CommandText|contains|all:
            - 'sp_procoption'
            - 'startup'
    condition: selection_create_login or selection_sysadmin_grant or selection_startup_proc
falsepositives:
    - Authorized DBA creating new service accounts for application deployments
    - Scheduled stored procedure maintenance by database administrators
level: critical

Known false positives:

• Authorized DBA creating new service accounts for legitimate application deployments
• Scheduled database maintenance tasks that create or modify stored procedures

Tuning notes: Correlate CREATE LOGIN events with sysadmin role grants within a short time window (e.g., 5 minutes) to reduce noise. Whitelist known DBA accounts and deployment automation service principals. The mvcount(actions) >= 2 threshold in SPL requires at least two distinct post-exploitation actions to fire.

• 🔒 CVE-2026-21262 Merge Replication Abuse via SQL Audit Events — Exploitation · unlock with TL Creds
• 🔒 CVE-2026-21262 Post-Exploitation — Login Creation and Role Escalation via Sentinel · unlock with TL Creds
• 🔒 CVE-2026-21262 C2/Lateral Movement — SQL Server OS Command Execution via Defender · unlock with TL Creds
• 🔒 CVE-2026-21262 Exploitation — Merge Replication and ALTER USER Abuse (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21262 Post-Exploitation — SQL Server Persistence Mechanisms (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21262 C2/Lateral Movement — SQL Server xp_cmdshell and Shell Execution (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-21262 Merge Replication Privilege Escalation — Exploitation · unlock with TL Creds
• 🔒 CVE-2026-21262 C2/Lateral Movement — xp_cmdshell and OS Command Execution · unlock with TL Creds

Indicators of compromise

As of 2026-03-12, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0216.

Technical analysis

Patched in Microsoft's March 2026 Patch Tuesday.

CVE-2026-21262 is a high-severity elevation of privilege vulnerability affecting all supported versions of Microsoft SQL Server (2016 SP3 through 2025). The flaw stems from improper access control (CWE-284) within the SQL Server Database Engine, specifically in how internal permission checks enforce role boundaries during certain database operations.

The vulnerability was publicly disclosed as a zero-day on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday, which addressed 83 total CVEs including two publicly disclosed zero-days. Security researcher Erland Sommarskog is credited with the discovery.

## Technical Root Cause

Analysis of the security update KB5077464 (SQL Server 2022 CU23) reveals two specific fixes:

1. **Bug 4945509**: An elevation of privilege vulnerability in the version upgrade process for merge replication. The merge replication subsystem failed to properly validate the caller's effective permissions during version upgrade operations, allowing a low-privileged user to invoke operations that should be restricted to sysadmin-equivalent roles.

2. **Bug 4934194**: The ALTER USER operation did not properly block attempts to target the system Administrator account. An attacker with limited privileges could manipulate user-to-login mappings to gain elevated access through the sa (system administrator) account.

These flaws combine to create a reliable privilege escalation path: an attacker with any valid SQL login (even a db_datareader or public role member) can craft specific T-SQL requests that abuse the flawed authorization checks in the merge replication subsystem to execute actions restricted to the sysadmin fixed server role.

## Attack Chain

1. **Initial Access**: Attacker obtains or already possesses a valid low-privilege SQL Server login (network authentication, stolen credentials, or compromised application service account) 2. **Exploitation**: Crafted T-SQL statements targeting the merge replication version upgrade process bypass permission checks 3. **Privilege Escalation**: Attacker achieves effective sysadmin privileges on the SQL Server instance 4. **Post-Exploitation**: With sysadmin access, the attacker can read/modify/delete all data, create new logins, alter permissions, deploy malicious triggers or stored procedures for persistence, and potentially execute OS commands via xp_cmdshell

## Exploitation Requirements

- Network-level connectivity to an affected SQL Server instance (TCP 1433 default or custom port) - Valid SQL Server login with any privilege level (cannot be exploited anonymously) - Low attack complexity — no user interaction required - Merge replication does NOT need to be actively configured on the target instance

## Scope & Impact

The vulnerability affects all supported on-premises SQL Server versions. Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics are NOT affected. SQL Server instances hosted on Azure IaaS virtual machines ARE affected.

Successful exploitation grants the attacker complete control over the database instance, including the ability to access all databases, execute administrative commands, create backdoor accounts, deploy persistent malicious objects (triggers, stored procedures, CLR assemblies), and — where xp_cmdshell is enabled or can be enabled — execute arbitrary operating system commands as the SQL Server service account.

## Related Vulnerabilities

Two additional SQL Server EoP vulnerabilities were patched in the same release: CVE-2026-26115 (improper input validation, CVSS 8.8) and CVE-2026-26116 (SQL injection in internal component, CVSS 8.8). While all three grant sysadmin privileges, CVE-2026-21262 is the only one that was publicly disclosed prior to patching.

MITRE ATT&CK techniques by tactic:

credential-access

T1003 OS Credential Dumping; T1552 Unsecured Credentials

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

discovery

T1069 Permission Groups Discovery; T1087 Account Discovery

defense-evasion

T1070 Indicator Removal; T1078 Valid Accounts; T1684.001 Impersonation

persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component

lateral-movement

T1210 Exploitation of Remote Services

collection

T1213 Data from Information Repositories

impact

T1485 Data Destruction; T1565 Data Manipulation

Remediation

Patches

• SQL Server 2016 SP3 GDR: KB5077474
• SQL Server 2017 GDR: KB5077472 / CU31: KB5077471
• SQL Server 2019 GDR: KB5077470 / CU32: KB5077469
• SQL Server 2022 GDR: KB5077465 / CU23: KB5077464
• SQL Server 2025 GDR: KB5077468 / CU2: KB5077466

Immediate actions

• Apply March 2026 Patch Tuesday security updates for all SQL Server instances
• Restrict network access to SQL Server instances via firewall rules (TCP 1433)
• Audit all SQL Server logins and remove unnecessary accounts
• Review and restrict merge replication permissions
• Monitor SQL Server error logs and Windows Security event logs for privilege escalation indicators

Workarounds

• Restrict SQL Server network exposure to trusted hosts only
• Remove unnecessary SQL logins and limit public role permissions
• Monitor for unusual ALTER USER, sp_addsrvrolemember, and merge replication operations
• Disable merge replication if not in active use

Longer-term hardening

• Implement network segmentation isolating database tier from general user networks
• Deploy database activity monitoring (DAM) solutions
• Enforce least-privilege principle for all SQL Server service accounts and application logins
• Implement multi-factor authentication for administrative database access paths
• Establish regular SQL Server patching cadence aligned with Patch Tuesday releases
• Disable xp_cmdshell and restrict CLR assembly creation where not required

Affected and fixed versions

• Microsoft — SQL Server 2016 Service Pack 3
  Vulnerable versions: All builds before KB5077474
  Fixed in: KB5077474 (GDR)
• Microsoft — SQL Server 2017
  Vulnerable versions: All builds before CU31/GDR
  Fixed in: KB5077471 (CU31); KB5077472 (GDR)
• Microsoft — SQL Server 2019
  Vulnerable versions: All builds before CU32/GDR
  Fixed in: KB5077469 (CU32); KB5077470 (GDR)
• Microsoft — SQL Server 2022
  Vulnerable versions: All builds before 16.0.4240.4
  Fixed in: KB5077464 (CU23, build 16.0.4240.4); KB5077465 (GDR)
• Microsoft — SQL Server 2025
  Vulnerable versions: All builds before CU2/GDR
  Fixed in: KB5077466 (CU2); KB5077468 (GDR)

Timeline

• 2026-03-10 Microsoft Security Response Center publishes advisory for CVE-2026-21262 with CVSS 8.8 rating and Important severity classification
• 2026-03-10 Microsoft releases security updates across all supported SQL Server versions: KB5077474 (2016 SP3), KB5077471 (2017 CU31), KB5077469 (2019 CU32), KB5077464 (2022 CU23), KB5077466 (2025 CU2)
• 2026-03-10 CVE-2026-21262 publicly disclosed as zero-day in Microsoft March 2026 Patch Tuesday release, credited to researcher Erland Sommarskog
• 2026-03-11 Tenable confirms CVE-2026-21262 alongside CVE-2026-26115 and CVE-2026-26116 as three SQL Server EoP vulnerabilities all scoring CVSS 8.8, with Microsoft rating exploitation as less likely
• 2026-03-11 Multiple security outlets (BleepingComputer, Tenable, Malwarebytes, Cisco Talos) publish analysis of CVE-2026-21262 as one of two zero-days in March Patch Tuesday
• 2026-03-12 Threadlinqs Intelligence completes deep analysis of CVE-2026-21262 including root cause identification via KB5077464 bug fix details
• 2026-03-12 SOC Prime publishes detection rules for CVE-2026-21262 exploitation mapped to MITRE ATT&CK framework for multiple SIEM platforms
• 2026-05-29 As of 2026-05-29, CVE-2026-21262 remains fully patched (Microsoft March 2026 updates across SQL Server 2016-2025) with no confirmed in-the-wild exploitation and no CISA KEV listing through the May 2026 catalog additions. Only a few GitHub PoCs exist for this unattributed, authenticated EoP flaw (CISA Vulnrichment: Exploitation none, Automatable no), so it stays PATCHED, not an active campaign.

Sources cited

• Microsoft Security Response Center - CVE-2026-21262 Microsoft Security Response Center · Vendor report · 2026-03-10
• KB5077464 - SQL Server 2022 CU23 Security Update Microsoft · Vendor report · 2026-03-10
• KB5077466 - SQL Server 2025 CU2 Security Update Microsoft · Vendor report · 2026-03-10
• Tenable: Microsoft March 2026 Patch Tuesday Addresses 83 CVEs Tenable · Research · 2026-03-11
• Cisco Talos: Microsoft Patch Tuesday March 2026 Cisco Talos · Research · 2026-03-11
• SOC Prime: CVE-2026-21262 SQL Server Elevation of Privilege socprime.com · Blog · 2026-03-12
• eSecurity Planet: Microsoft SQL Server Vulnerability Enables Privilege Escalation esecurityplanet.com · Blog · 2026-03-11
• Security Boulevard: CVE-2026-21262 Analysis securityboulevard.com · Blog · 2026-03-11
• BleepingComputer: March 2026 Patch Tuesday Fixes 2 Zero-Days BleepingComputer · News · 2026-03-10
• Cybersecurity News: Microsoft SQL Server Zero-Day Vulnerability cybersecuritynews.com · News · 2026-03-11
• Malwarebytes: March 2026 Patch Tuesday Fixes Two Zero-Day Vulnerabilities malwarebytes.com · News · 2026-03-11
• Help Net Security: Microsoft Patches 80+ Vulnerabilities Help Net Security · News · 2026-03-11

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Other reports on CVE-2026-21262

• Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesday

Previous and next in vulnerability

• CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing Previous report