Critical SQL Server zero-day lets attackers escalate to full admin control
TL;DR Summary
Microsoft disclosed a critical zero-day in SQL Server (CVE-2026-21262) that enables an authenticated attacker to escalate to the sysadmin role via improper access control. The flaw has a CVSS v3.1 base score of 8.8 (Important) and is exploitable over the network with low complexity and no user interaction. While not yet observed in the wild, the disclosure lowers the barrier for exploits. Microsoft has released patches for SQL Server 2016–2025; administrators should urgently apply updates, audit permissions, restrict privileged access, and upgrade unsupported versions to receive future fixes.
- Microsoft SQL Server Zero-Day Vulnerability Allows Attackers to Escalate Privileges CyberSecurityNews
- Microsoft Patch Tuesday, March 2026 Edition Krebs on Security
- Microsoft Patches 83 Vulnerabilities SecurityWeek
- Microsoft Patches 83 CVEs in March Update Dark Reading | Security
- Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days The Hacker News
Reading Insights
Total Reads
0
Unique Readers
1
Time Saved
53 min
vs 54 min read
Condensed
99%
10,685 → 88 words
Want the full story? Read the original article
Read on CyberSecurityNews