CVE-2026-21262
Published: 10 March 2026
Summary
CVE-2026-21262 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Sql Server 2016. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-21262, published on 2026-03-10, is an improper access control vulnerability (CWE-284) affecting SQL Server. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited by an authorized attacker with low privileges over a network connection. Exploitation requires low complexity and no user interaction, allowing the attacker to elevate privileges on the affected SQL Server instance.
Mitigation details are available in the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10569
Vulnerability details
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables privilege escalation via remote exploitation of improper access control in SQL Server by low-privileged authenticated attackers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper access control flaw in SQL Server by applying vendor security patches.
Enforces least privilege to limit low-privileged users' ability to exploit the vulnerability for elevation.
Mandates enforcement of approved access authorizations, countering the improper access control allowing privilege escalation.