CVE-2026-21262: Microsoft SQL Server Elevation of Privilege via Improper Access Control in Merge Replication

CVE-2026-21262 (TL-2026-0216) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-03-12. It has no confirmed attribution, affects Microsoft SQL Server 2016 Service Pack 3, references 1 CVE (CVE-2026-21262), maps to 17 MITRE ATT&CK techniques (T1003, T1041, T1059), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0216

Threat ID
TL-2026-0216
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-12
Last reviewed
2026-03-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
financial, healthcare, government, technology, retail, manufacturing, education, energy
Target regions
Global
Detection rules
9
Indicators of compromise
15

A publicly disclosed zero-day elevation of privilege vulnerability (CVSS 8.8) in Microsoft SQL Server 2016 SP3 through 2025 allows an authenticated low-privilege attacker to escalate to sysadmin-level access over the network by exploiting improper permission checks in the merge replication version upgrade process. Patched in Microsoft's March 2026 Patch Tuesday.

How CVE-2026-21262 works

CVE-2026-21262 is a high-severity elevation of privilege vulnerability affecting all supported versions of Microsoft SQL Server (2016 SP3 through 2025). The flaw stems from improper access control (CWE-284) within the SQL Server Database Engine, specifically in how internal permission checks enforce role boundaries during certain database operations.

The vulnerability was publicly disclosed as a zero-day on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday, which addressed 83 total CVEs including two publicly disclosed zero-days. Security researcher Erland Sommarskog is credited with the discovery.

## Technical Root Cause

Analysis of the security update KB5077464 (SQL Server 2022 CU23) reveals two specific fixes:

1. **Bug 4945509**: An elevation of privilege vulnerability in the version upgrade process for merge replication. The merge replication subsystem failed to properly validate the caller's effective permissions during version upgrade operations, allowing a low-privileged user to invoke operations that should be restricted to sysadmin-equivalent roles.

2. **Bug 4934194**: The ALTER USER operation did not properly block attempts to target the system Administrator account. An attacker with limited privileges could manipulate user-to-login mappings to gain elevated access through the sa (system administrator) account.

These flaws combine to create a reliable privilege escalation path: an attacker with any valid SQL login (even a db_datareader or public role member) can craft specific T-SQL requests that abuse the flawed authorization checks in the merge replication subsystem to execute actions restricted to the sysadmin fixed server role.

## Attack Chain

1. **Initial Access**: Attacker obtains or already possesses a valid low-privilege SQL Server login (network authentication, stolen credentials, or compromised application service account) 2. **Exploitation**: Crafted T-SQL statements targeting the merge replication version upgrade process bypass permission checks 3. **Privilege Escalation**: Attacker achieves effective sysadmin privileges on the SQL Server instance 4. **Post-Exploitation**: With sysadmin access, the attacker can read/modify/delete all data, create new logins, alter permissions, deploy malicious triggers or stored procedures for persistence, and potentially execute OS commands via xp_cmdshell

## Exploitation Requirements

- Network-level connectivity to an affected SQL Server instance (TCP 1433 default or custom port) - Valid SQL Server login with any privilege level (cannot be exploited anonymously) - Low attack complexity — no user interaction required - Merge replication does NOT need to be actively configured on the target instance

## Scope & Impact

The vulnerability affects all supported on-premises SQL Server versions. Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics are NOT affected. SQL Server instances hosted on Azure IaaS virtual machines ARE affected.

Successful exploitation grants the attacker complete control over the database instance, including the ability to access all databases, execute administrative commands, create backdoor accounts, deploy persistent malicious objects (triggers, stored procedures, CLR assemblies), and — where xp_cmdshell is enabled or can be enabled — execute arbitrary operating system commands as the SQL Server service account.

## Related Vulnerabilities

Two additional SQL Server EoP vulnerabilities were patched in the same release: CVE-2026-26115 (improper input validation, CVSS 8.8) and CVE-2026-26116 (SQL injection in internal component, CVSS 8.8). While all three grant sysadmin privileges, CVE-2026-21262 is the only one that was publicly disclosed prior to patching.

MITRE ATT&CK techniques used in TL-2026-0216

credential-access

T1003 OS Credential Dumping; T1552 Unsecured Credentials

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

discovery

T1069 Permission Groups Discovery; T1087 Account Discovery

defense-evasion

T1070 Indicator Removal; T1078 Valid Accounts; T1684.001 Impersonation

persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component

lateral-movement

T1210 Exploitation of Remote Services

collection

T1213 Data from Information Repositories

impact

T1485 Data Destruction; T1565 Data Manipulation

Affected products and versions in CVE-2026-21262

  • Microsoft — SQL Server 2016 Service Pack 3
    Vulnerable versions: All builds before KB5077474
    Fixed in: KB5077474 (GDR)
  • Microsoft — SQL Server 2017
    Vulnerable versions: All builds before CU31/GDR
    Fixed in: KB5077471 (CU31); KB5077472 (GDR)
  • Microsoft — SQL Server 2019
    Vulnerable versions: All builds before CU32/GDR
    Fixed in: KB5077469 (CU32); KB5077470 (GDR)
  • Microsoft — SQL Server 2022
    Vulnerable versions: All builds before 16.0.4240.4
    Fixed in: KB5077464 (CU23, build 16.0.4240.4); KB5077465 (GDR)
  • Microsoft — SQL Server 2025
    Vulnerable versions: All builds before CU2/GDR
    Fixed in: KB5077466 (CU2); KB5077468 (GDR)

Remediation for CVE-2026-21262

Patches

  • SQL Server 2016 SP3 GDR: KB5077474
  • SQL Server 2017 GDR: KB5077472 / CU31: KB5077471
  • SQL Server 2019 GDR: KB5077470 / CU32: KB5077469
  • SQL Server 2022 GDR: KB5077465 / CU23: KB5077464
  • SQL Server 2025 GDR: KB5077468 / CU2: KB5077466

Immediate actions

  • Apply March 2026 Patch Tuesday security updates for all SQL Server instances
  • Restrict network access to SQL Server instances via firewall rules (TCP 1433)
  • Audit all SQL Server logins and remove unnecessary accounts
  • Review and restrict merge replication permissions
  • Monitor SQL Server error logs and Windows Security event logs for privilege escalation indicators

Workarounds

  • Restrict SQL Server network exposure to trusted hosts only
  • Remove unnecessary SQL logins and limit public role permissions
  • Monitor for unusual ALTER USER, sp_addsrvrolemember, and merge replication operations
  • Disable merge replication if not in active use

Longer-term hardening

  • Implement network segmentation isolating database tier from general user networks
  • Deploy database activity monitoring (DAM) solutions
  • Enforce least-privilege principle for all SQL Server service accounts and application logins
  • Implement multi-factor authentication for administrative database access paths
  • Establish regular SQL Server patching cadence aligned with Patch Tuesday releases
  • Disable xp_cmdshell and restrict CLR assembly creation where not required

CVEs associated with CVE-2026-21262

CVE-2026-21262

Weaknesses (CWE) in CVE-2026-21262

CWE-284

Timeline of CVE-2026-21262

  • Microsoft Security Response Center publishes advisory for CVE-2026-21262 with CVSS 8.8 rating and Important severity classification
  • Microsoft releases security updates across all supported SQL Server versions: KB5077474 (2016 SP3), KB5077471 (2017 CU31), KB5077469 (2019 CU32), KB5077464 (2022 CU23), KB5077466 (2025 CU2)
  • CVE-2026-21262 publicly disclosed as zero-day in Microsoft March 2026 Patch Tuesday release, credited to researcher Erland Sommarskog
  • Tenable confirms CVE-2026-21262 alongside CVE-2026-26115 and CVE-2026-26116 as three SQL Server EoP vulnerabilities all scoring CVSS 8.8, with Microsoft rating exploitation as less likely
  • Multiple security outlets (BleepingComputer, Tenable, Malwarebytes, Cisco Talos) publish analysis of CVE-2026-21262 as one of two zero-days in March Patch Tuesday
  • Threadlinqs Intelligence completes deep analysis of CVE-2026-21262 including root cause identification via KB5077464 bug fix details
  • SOC Prime publishes detection rules for CVE-2026-21262 exploitation mapped to MITRE ATT&CK framework for multiple SIEM platforms
  • As of 2026-05-29, CVE-2026-21262 remains fully patched (Microsoft March 2026 updates across SQL Server 2016-2025) with no confirmed in-the-wild exploitation and no CISA KEV listing through the May 2026 catalog additions. Only a few GitHub PoCs exist for this unattributed, authenticated EoP flaw (CISA Vulnrichment: Exploitation none, Automatable no), so it stays PATCHED, not an active campaign.

Sources cited for CVE-2026-21262

More in vulnerability

Detection coverage for TL-2026-0216

As of 2026-03-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0216 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats