CVE-2026-21262

8.8

HIGH CVSS 3.1

SQL Server Elevation of Privilege Vulnerability

Overview

Description

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Details

INFO

Published Date :

March 10, 2026, 6:18 p.m.

Last Modified :

March 13, 2026, 7:33 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-21262 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	sql_server_2016
2	Microsoft	sql_server_2017
3	Microsoft	sql_server_2019
4	Microsoft	sql_server_2022
5	Microsoft	sql_server_2025

: Total Affected Vendor : 1 | Products : 5

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Restrict SQL Server access and apply vendor patches to prevent privilege escalation.

Enforce least privilege access controls.
Apply SQL Server security updates promptly.
Monitor access logs for suspicious activity.
Configure network access controls.

Public PoC/Exploit Available at Github

CVE-2026-21262 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-21262.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-21262 is associated with the following CWEs:

CWE-284: Improper Access Control

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-21262 weaknesses.

CAPEC-19: Embedding Scripts within Scripts Embedding Scripts within Scripts CAPEC-441: Malicious Logic Insertion Malicious Logic Insertion CAPEC-478: Modification of Windows Service Configuration Modification of Windows Service Configuration CAPEC-479: Malicious Root Certificate Malicious Root Certificate CAPEC-502: Intent Spoof Intent Spoof CAPEC-503: WebView Exposure WebView Exposure CAPEC-536: Data Injected During Configuration Data Injected During Configuration CAPEC-546: Incomplete Data Deletion in a Multi-Tenant Environment Incomplete Data Deletion in a Multi-Tenant Environment CAPEC-550: Install New Service Install New Service CAPEC-551: Modify Existing Service Modify Existing Service CAPEC-552: Install Rootkit Install Rootkit CAPEC-556: Replace File Extension Handlers Replace File Extension Handlers CAPEC-558: Replace Trusted Executable Replace Trusted Executable CAPEC-562: Modify Shared File Modify Shared File CAPEC-563: Add Malicious File to Shared Webroot Add Malicious File to Shared Webroot CAPEC-564: Run Software at Logon Run Software at Logon CAPEC-578: Disable Security Software Disable Security Software

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

TMLVOD/spencerg

This reposityory will be used to store my public portfolio

PowerShell

Updated: 1 hour, 37 minutes ago

0 stars 0 fork 0 watcher

Born at : March 21, 2026, 2:58 p.m. This repo has been linked 5 different CVEs too.

j-dahl7/mcp-attack-detection-sentinel

Sentinel detection lab for MCP attack chains: CVE-2026-26118 SSRF token theft, tool poisoning, cross-server exfiltration, identity post-exploitation. Maps to OWASP Agentic Top 10. 5 analytics rules, 7 hunting queries, workbook. Companion to nineliveszerotrust.com.

PowerShell

Updated: 2 weeks, 5 days ago

0 stars 0 fork 0 watcher

Born at : March 17, 2026, 4:37 p.m. This repo has been linked 3 different CVEs too.

SimminsVuln/temprepo

Report Template

Updated: 3 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Oct. 11, 2023, 3:51 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-21262 vulnerability anywhere in the article.

Help Net Security

Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Turning expertise into opportunity for women in cybersecurity Speaker diversity in cybersecurity has b ...

Published Date: Mar 15, 2026 (3 weeks ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 11

The Good | Authorities Disrupt Proxy Network and Charge BlackCat Insider, Vendors Patch Critical RCE Bugs U.S. and European law enforcement have dismantled the SocksEscort cybercrime proxy network, wh ...

Published Date: Mar 13, 2026 (3 weeks, 2 days ago)

SentinelOne

The Good, the Bad and the Ugly in Cybersecurity – Week 11

Published Date: Mar 13, 2026 (3 weeks, 2 days ago)

Help Net Security

Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited

On March 2026 Patch Tuesday, Microsoft addressed 80+ vulnerabilities affecting its software and cloud services. Of these, two were publicly disclosed, but not actively exploited. Privilege escalation ...