CVE-2026-21262
Published: 10 March 2026
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2026-21262, published on 2026-03-10, is an improper access control vulnerability (CWE-284) affecting SQL Server. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited by an authorized attacker with low privileges over a network connection. Exploitation requires low complexity and no user interaction, allowing the attacker to elevate privileges on the affected SQL Server instance.
Mitigation details are available in the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables privilege escalation via remote exploitation of improper access control in SQL Server by low-privileged authenticated attackers.