# CVE-2026-21262: Microsoft SQL Server Elevation of Privilege via Improper Access Control in Merge Replication

> A publicly disclosed zero-day elevation of privilege vulnerability (CVSS 8.8) in Microsoft SQL Server 2016 SP3 through 2025 allows an authenticated low-privilege attacker to escalate to sysadmin-level access over the network by exploiting improper permission checks in the merge replication version upgrade process. Patched in Microsoft's March 2026 Patch Tuesday.

- **Published:** 2026-03-12T12:00:00Z
- **Last reviewed:** 2026-03-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0216
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sql-server-sysadmin-escalation-tl-2026-0216.webp?v=a5531a82 (Threadlinqs threat intel: CVE-2026-21262 SQL Server Replication: Detection & IOCs (TL-2026-0216) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0216
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-21262

## Description

CVE-2026-21262 is a high-severity elevation of privilege vulnerability affecting all supported versions of Microsoft SQL Server (2016 SP3 through 2025). The flaw stems from improper access control (CWE-284) within the SQL Server Database Engine, specifically in how internal permission checks enforce role boundaries during certain database operations.

The vulnerability was publicly disclosed as a zero-day on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday, which addressed 83 total CVEs including two publicly disclosed zero-days. Security researcher Erland Sommarskog is credited with the discovery.

## Technical Root Cause

Analysis of the security update KB5077464 (SQL Server 2022 CU23) reveals two specific fixes:

1. **Bug 4945509**: An elevation of privilege vulnerability in the version upgrade process for merge replication. The merge replication subsystem failed to properly validate the caller's effective permissions during version upgrade operations, allowing a low-privileged user to invoke operations that should be restricted to sysadmin-equivalent roles.

2. **Bug 4934194**: The ALTER USER operation did not properly block attempts to target the system Administrator account. An attacker with limited privileges could manipulate user-to-login mappings to gain elevated access through the sa (system administrator) account.

These flaws combine to create a reliable privilege escalation path: an attacker with any valid SQL login (even a db_datareader or public role member) can craft specific T-SQL requests that abuse the flawed authorization checks in the merge replication subsystem to execute actions restricted to the sysadmin fixed server role.

## Attack Chain

1. **Initial Access**: Attacker obtains or already possesses a valid low-privilege SQL Server login (network authentication, stolen credentials, or compromised application service account)
2. **Exploitation**: Crafted T-SQL statements targeting the merge replication version upgrade process bypass permission checks
3. **Privilege Escalation**: Attacker achieves effective sysadmin privileges on the SQL Server instance
4. **Post-Exploitation**: With sysadmin access, the attacker can read/modify/delete all data, create new logins, alter permissions, deploy malicious triggers or stored procedures for persistence, and potentially execute OS commands via xp_cmdshell

## Exploitation Requirements

- Network-level connectivity to an affected SQL Server instance (TCP 1433 default or custom port)
- Valid SQL Server login with any privilege level (cannot be exploited anonymously)
- Low attack complexity — no user interaction required
- Merge replication does NOT need to be actively configured on the target instance

## Scope & Impact

The vulnerability affects all supported on-premises SQL Server versions. Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics are NOT affected. SQL Server instances hosted on Azure IaaS virtual machines ARE affected.

Successful exploitation grants the attacker complete control over the database instance, including the ability to access all databases, execute administrative commands, create backdoor accounts, deploy persistent malicious objects (triggers, stored procedures, CLR assemblies), and — where xp_cmdshell is enabled or can be enabled — execute arbitrary operating system commands as the SQL Server service account.

## Related Vulnerabilities

Two additional SQL Server EoP vulnerabilities were patched in the same release: CVE-2026-26115 (improper input validation, CVSS 8.8) and CVE-2026-26116 (SQL injection in internal component, CVSS 8.8). While all three grant sysadmin privileges, CVE-2026-21262 is the only one that was publicly disclosed prior to patching.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1505 Server Software Component
- T1136 Create Account
- T1098 Account Manipulation
- T1059 Command and Scripting Interpreter
- T1070 Indicator Removal
- T1684.001 Impersonation
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1213 Data from Information Repositories
- T1210 Exploitation of Remote Services
- T1485 Data Destruction
- T1565 Data Manipulation
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-21262 Post-Exploitation — Backdoor Account and Persistence** (`TL-2026-0216-SPL-002`)

Detects post-exploitation activity following CVE-2026-21262 privilege escalation: creation of new SQL logins, sysadmin role assignment via sp_addsrvrolemember or ALTER SERVER ROLE, and stored procedure persistence via sp_procoption startup registration. These actions indicate an attacker consolidating sysadmin access with backdoor accounts and persistent code execution.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1098, T1136.001, T1505.001
- **Data sources:** mssql_audit, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=mssql sourcetype="MSSQL:Audit:Event" OR sourcetype="MSSQL:Error"
(statement="*CREATE LOGIN*" OR statement="*sp_addsrvrolemember*" OR statement="*ALTER SERVER ROLE*sysadmin*ADD MEMBER*" OR statement="*sp_procoption*startup*" OR statement="*CREATE PROCEDURE*")
| eval post_exploit_action=case(
    match(statement, "(?i)CREATE\s+LOGIN"), "backdoor_login_created",
    match(statement, "(?i)sp_addsrvrolemember|ALTER\s+SERVER\s+ROLE.*sysadmin.*ADD\s+MEMBER"), "sysadmin_role_granted",
    match(statement, "(?i)sp_procoption.*startup"), "startup_procedure_registered",
    match(statement, "(?i)CREATE\s+PROCEDURE"), "stored_procedure_created",
    1=1, "unknown")
| stats count values(post_exploit_action) as actions values(statement) as statements min(_time) as first_seen max(_time) as last_seen by host, login_name, database_name, client_ip
| where mvcount(actions) >= 2
| sort -last_seen
```

### Microsoft KQL

```kql
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.SQL" or Category == "SQLSecurityAuditEvents"
| where TimeGenerated > ago(24h)
| where statement_s has_any ("CREATE LOGIN", "sp_addsrvrolemember", "ALTER SERVER ROLE", "sp_procoption", "CREATE PROCEDURE")
| extend PostExploitAction = case(
    statement_s has "CREATE LOGIN", "backdoor_login_created",
    statement_s has_any ("sp_addsrvrolemember", "ALTER SERVER ROLE"), "sysadmin_role_granted",
    statement_s has "sp_procoption", "startup_procedure_registered",
    statement_s has "CREATE PROCEDURE", "stored_procedure_created",
    "unknown")
| summarize ActionCount=dcount(PostExploitAction), Actions=make_set(PostExploitAction), Statements=make_set(statement_s), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by server_principal_name_s, host_s, database_name_s, client_ip_s
| where ActionCount >= 2
| sort by LastSeen desc
```

### Sigma

```yaml
title: CVE-2026-21262 Post-Exploitation — Backdoor Account and Persistence
id: a8b2c3d4-e5f6-4a78-9012-bcdef1234567
status: experimental
description: Detects post-exploitation persistence after CVE-2026-21262 privilege escalation including backdoor SQL login creation, sysadmin role assignment, and stored procedure startup persistence
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262
    - https://intel.threadlinqs.com/threats/TL-2026-0216
author: Threadlinqs Team
date: 2026/03/12
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1136.001
    - attack.t1505.001
    - cve.2026.21262
logsource:
    product: mssql
    service: application
detection:
    selection_create_login:
        CommandText|contains:
            - 'CREATE LOGIN'
    selection_sysadmin_grant:
        CommandText|contains:
            - 'sp_addsrvrolemember'
            - 'ALTER SERVER ROLE sysadmin ADD MEMBER'
    selection_startup_proc:
        CommandText|contains|all:
            - 'sp_procoption'
            - 'startup'
    condition: selection_create_login or selection_sysadmin_grant or selection_startup_proc
falsepositives:
    - Authorized DBA creating new service accounts for application deployments
    - Scheduled stored procedure maintenance by database administrators
level: critical
```

**Known false positives:**

- Authorized DBA creating new service accounts for legitimate application deployments
- Scheduled database maintenance tasks that create or modify stored procedures

**Tuning notes:** Correlate CREATE LOGIN events with sysadmin role grants within a short time window (e.g., 5 minutes) to reduce noise. Whitelist known DBA accounts and deployment automation service principals. The mvcount(actions) >= 2 threshold in SPL requires at least two distinct post-exploitation actions to fire.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-21262 Merge Replication Abuse via SQL Audit Events — Exploitation (locked: unlock with TL Creds)
- CVE-2026-21262 Post-Exploitation — Login Creation and Role Escalation via Sentinel (locked: unlock with TL Creds)
- CVE-2026-21262 C2/Lateral Movement — SQL Server OS Command Execution via Defender (locked: unlock with TL Creds)
- CVE-2026-21262 Exploitation — Merge Replication and ALTER USER Abuse (Sigma) (locked: unlock with TL Creds)
- CVE-2026-21262 Post-Exploitation — SQL Server Persistence Mechanisms (Sigma) (locked: unlock with TL Creds)
- CVE-2026-21262 C2/Lateral Movement — SQL Server xp_cmdshell and Shell Execution (Sigma) (locked: unlock with TL Creds)
- CVE-2026-21262 Merge Replication Privilege Escalation — Exploitation (locked: unlock with TL Creds)
- CVE-2026-21262 C2/Lateral Movement — xp_cmdshell and OS Command Execution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Microsoft Security Response Center - CVE-2026-21262](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262)
- [KB5077464 - SQL Server 2022 CU23 Security Update](https://support.microsoft.com/en-us/topic/kb5077464-description-of-the-security-update-for-sql-server-2022-cu23-march-10-2026-b57d8bd7-e9f5-48a8-8a6f-2a52d3ad29f0)
- [KB5077466 - SQL Server 2025 CU2 Security Update](https://support.microsoft.com/en-us/topic/kb5077466-description-of-the-security-update-for-sql-server-2025-cu2-march-10-2026-e09ecd69-b429-47e8-835c-3bcd107330e5)
- [SOC Prime: CVE-2026-21262 SQL Server Elevation of Privilege](https://socprime.com/blog/cve-2026-21262-vulnerability/)
- [Tenable: Microsoft March 2026 Patch Tuesday Addresses 83 CVEs](https://www.tenable.com/blog/microsofts-march-2026-patch-tuesday-addresses-83-cves-cve-2026-21262-cve-2026-26127)
- [BleepingComputer: March 2026 Patch Tuesday Fixes 2 Zero-Days](https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/)
- [Cybersecurity News: Microsoft SQL Server Zero-Day Vulnerability](https://cybersecuritynews.com/microsoft-sql-server-zero-day-vulnerability/)
- [eSecurity Planet: Microsoft SQL Server Vulnerability Enables Privilege Escalation](https://www.esecurityplanet.com/threats/microsoft-sql-server-vulnerability-enables-privilege-escalation/)
- [Security Boulevard: CVE-2026-21262 Analysis](https://securityboulevard.com/2026/03/microsoft-sql-server-elevation-of-privilege-vulnerability-cve-2026-21262/)
- [Malwarebytes: March 2026 Patch Tuesday Fixes Two Zero-Day Vulnerabilities](https://www.malwarebytes.com/blog/news/2026/03/march-2026-patch-tuesday-fixes-two-zero-day-vulnerabilities)
- [Help Net Security: Microsoft Patches 80+ Vulnerabilities](https://www.helpnetsecurity.com/2026/03/11/march-2026-patch-tuesday/)
- [Cisco Talos: Microsoft Patch Tuesday March 2026](https://blog.talosintelligence.com/microsoft-patch-tuesday-march-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0216