Review reviewHigh

CVE-2026-21262

Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31)

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability2.04%

Technical severityCVSS 8.8

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Product: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31)
Affected versions: 13.0.0, 14.0.0, 15.0.0.0, 15.0.0, 16.0.0, 16.0.0.0, 17.0.0.0, 17.0.1050.2, >= 13.0.6300.2 < 13.0.6480.4, >= 13.0.7000.253 < 13.0.7075.5, >= 14.0.1000.169 < 14.0.2100.4, >= 14.0.3006.16 < 14.0.3520.4, >= 15.0.2000.5 < 15.0.2160.4, >= 15.0.4003.23 < 15.0.4460.4, >= 16.0.1000.6 < 16.0.1170.5, >= 16.0.4003.1 < 16.0.4240.4, >= 17.0.1000.7 < 17.0.1105.2, >= 17.0.4006.2 < 17.0.4020.2
Fixed versions: 13.0.6480.4, 13.0.7075.5, 14.0.2100.4, 14.0.3520.4, 15.0.2160.4, 15.0.4460.4, 16.0.1170.5, 16.0.4240.4, 17.0.1105.2, 17.0.4020.2

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR), Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft SQL Server 2017 (CU 31) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.