TL;DR — CVE-2026-21262: Patch Now, Scope is Massive
Bottom line: Any user with a SQL Server login — your app service account, a contractor's read-only credentials, even a guest account — can own the entire database server. If your SQL Server is internet-accessible and unpatched, assume it is already compromised.
Vulnerability Details
Microsoft confirmed exploitation in the wild prior to the March 10 patch release. This means threat actors — including ransomware groups — already had working exploits before defenders had a fix. The window between public knowledge and mass exploitation for this class of vulnerability is typically under 48 hours.
Attack Chain: 3 Steps to Full Database Control
The attack requires no special tooling — just a SQL client and valid credentials. The entire chain can execute in under 60 seconds on an unpatched target.
What Attackers Can Do With Sysadmin Access
Sysadmin in SQL Server is equivalent to root on Linux or SYSTEM on Windows. From this position, attackers can do everything — and typically do:
SELECT * FROM master..sysdatabases SELECT * FROM SensitiveTable
EXEC xp_cmdshell 'whoami' EXEC xp_cmdshell 'net user attacker P@ss123 /add'
CREATE LOGIN backdoor WITH PASSWORD='P@ss123!' EXEC sp_addsrvrolemember 'backdoor','sysadmin'
SELECT * FROM OPENROWSET('SQLNCLI','...',
'SELECT sensitive_col FROM prod_db.dbo.customers')ALTER SERVER AUDIT [AuditSpec] WITH (STATE=OFF) DROP SERVER AUDIT [AuditSpec]
EXEC xp_cmdshell 'powershell -enc <b64_payload>' -- Encrypt SQL Server data files in place
Affected Versions & Required Patches
| Version | Last Vulnerable Build | Status | KB Article |
|---|---|---|---|
| SQL Server 2016 SP3 | CU17 GDR and earlier | VULNERABLE | KB5040946 |
| SQL Server 2017 | CU31 GDR and earlier | VULNERABLE | KB5040939 |
| SQL Server 2019 | CU28 GDR and earlier | VULNERABLE | KB5046860 |
| SQL Server 2022 | CU16 GDR and earlier | VULNERABLE | KB5077465 |
| SQL Server 2025 | RTM and earlier | VULNERABLE | KB5077480 |
Microsoft-managed cloud SQL services were patched automatically. No action required for Azure SQL Database or SQL Managed Instance deployments.
Global Exposure: 500K+ Internet-Accessible Instances
Shodan indexes over 500,000 SQL Server instances accessible on TCP/1433 from the public internet. Many are production databases — not dev or test — because "it's always been open" or because an app deployment opened the port and nobody noticed.
Geographic Distribution (Shodan, March 2026)
Brazil alone accounts for ~25,000 exposed instances. Mexico, Colombia, and Argentina contribute an additional ~15,000 combined. Many are SMB deployments running SQL Server 2016 or 2017 with no automatic updates configured — the highest-risk cohort for this vulnerability.
Mitigation: 5 Steps to Remediate
Patch first. Then harden. Then detect. In that order.
-- Verify current SQL Server version: SELECT @@VERSION -- You need: -- SQL 2022: KB5077465 (build 16.0.4175.1+) -- SQL 2019: KB5046860 (build 15.0.4430.1+) -- SQL 2017: KB5040939 (build 14.0.3485.1+) -- SQL 2016: KB5040946 (build 13.0.6445.1+)
# Block TCP/1433 on firewall for all IPs except app servers: iptables -A INPUT -p tcp --dport 1433 -s 10.0.0.0/8 -j ACCEPT iptables -A INPUT -p tcp --dport 1433 -j DROP # Or in Windows Firewall: netsh advfirewall firewall add rule name="SQL Block" protocol=TCP dir=in localport=1433 action=block
-- List all sysadmin members:
SELECT name, type_desc, is_disabled
FROM sys.server_principals
WHERE IS_SRVROLEMEMBER('sysadmin', name) = 1
-- Disable SQL auth if using Windows-only:
ALTER LOGIN [sa] DISABLE-- Create server audit: CREATE SERVER AUDIT [SecurityAudit] TO FILE (FILEPATH = 'C:\SQLAudit\') WITH (ON_FAILURE = CONTINUE); ALTER SERVER AUDIT [SecurityAudit] WITH (STATE = ON); -- Monitor failed logins and privilege changes: CREATE SERVER AUDIT SPECIFICATION [LoginAudit] FOR SERVER AUDIT [SecurityAudit] ADD (FAILED_LOGIN_GROUP), ADD (SERVER_PRINCIPAL_CHANGE_GROUP);
-- Rotate sa and all service account passwords: ALTER LOGIN [sa] WITH PASSWORD = '<new-strong-password>'; ALTER LOGIN [app_service] WITH PASSWORD = '<new-strong-password>'; -- Revoke unnecessary permissions: REVOKE CONNECT SQL FROM [low_priv_user]; DROP USER [unused_account];
Detection Queries: Hunt for Active Exploitation
If you can't patch immediately, run these queries to detect signs of compromise. Unexplained sysadmin additions or xp_cmdshell calls are immediate red flags.
SELECT
event_time,
server_principal_name,
target_server_principal_name,
statement
FROM sys.fn_get_audit_file('C:\SQLAudit\*', DEFAULT, DEFAULT)
WHERE action_id = 'ADRO'
AND class_type = 'SR' -- Server RoleSELECT
event_time,
server_principal_name,
statement
FROM sys.fn_get_audit_file('C:\SQLAudit\*', DEFAULT, DEFAULT)
WHERE statement LIKE '%xp_cmdshell%'
ORDER BY event_time DESC-- Run from server: nmap -sV -p 1433 $(curl -s ifconfig.me) -- If open: your SQL Server is internet-accessible
March 2026 Patch Tuesday: Other Critical CVEs
83 CVEs were patched in the same release. These four are worth immediate attention for startup and enterprise environments:
CVE-2026-26115PATCHEDSQL Server EoP via linked server — same March 2026 patch batch
CVE-2026-26127PATCHED.NET Framework DoS — publicly disclosed zero-day, same Patch Tuesday
CVE-2026-26144PATCHEDMicrosoft Copilot data exfiltration via prompt injection
CVE-2026-21536PATCHEDMicrosoft Devices Pricing Program RCE — unrestricted file upload