SQL Server 2016 – the Final Countdown: SQL Server 2016 Is Becoming a Serious Security Risk
June 24, 2026
This post is part of a series we are calling “SQL Server 2016 – The Final Countdown.” For many companies SQL Server 2016 is a reliable database management system. It has worked well for several years and let’s be honest; it isn’t broken, so why fix it? We all have several high-priority tasks; everything from
RC4 Is Going Away in July 2026: What CVE-2026-20833 Means for Your SQL Server and Windows Environment
June 23, 2026
In July 2026 Microsoft is making a change that may impact your environment. The change being implemented will make your environment more secure by no longer accepting the RC4 algorithm for the Kerberos protocol by default. The problem though is it could cause authentication failures, services to not start, and Kerberos to stop working. Microsoft
SQL Server Critical Security Patch Alert
March 12, 2026
I should just create a blog post template for these, it feels like every 1 to 3 months we have another critical one to share. But here we are again, just yesterday, Microsoft released a fix for CVE-2026-2162. This one can, ultimately, lead to anyone with a SQL login and the ingredients for the exploit
SQL Server Vulnerability Alert: CVE-2025-59499
November 12, 2025
This isn’t in the SQL Server Regrets series of posts, but another great band from that era once started a song with, “Stop me, oh stop me… Stop me if you think that you’ve heart this one before… Stop me, oh oh oh , Stop me. Stop me if you think that you’ve heard this
Updates and improvements to sp_CheckSecurity
October 15, 2025
It’s been a while since we made some improvements to the public version of sp_CheckSecurity, but internally we’ve been busy fine tuning checks and adding even more to discover potential vulnerabilities in your SQL Server instances. Today we’re announcing a new version that includes additions, corrections, and a few other adjustments that should be helpful.
Your Silent Face: The Illusion of the Safety of “Never Patching” Your SQL Servers.
July 10, 2025
No hearing, or breathing… No movement, no colors… Just silence… Sounds peaceful. Sounds serene. And in a world where entropy didn’t exist, it could even stay that way. That’s not our world, though. Our SQL Servers (in whatever flavor they exist) don’t live in utopia. They live in a world where bad actors are trying
SQL Server Vulnerability Alert: CVE-2025-49719
July 10, 2025
On patch Tuesday this week, Microsoft released an Important severity security update (a CVSS base score of 7.5) The details of this 0-day exploit are available to read at the NIST site, and the Microsoft security update site. In short, the exploit that Microsoft has discovered and subsequently fixed can allow information disclosure. (That’s the
Managing Orphaned Users in SQL Server with sp_FindOrphanedUser
September 26, 2024
Addressing orphaned users is an important piece of SQL Server security management. When left unchecked, you can accumulate an overwhelming number of users that exist in a database but do not have a correlating login in the master database, thus preventing access to the server or the database at all. There are dbatools PowerShell modules
SQL Server Security: 3 Homework Assignments to Start Today
June 30, 2024
This post is part of our SQL Server security blog series, 30 SQL Server Security Checks in 30 Days. We’re publishing a new security check every day in the month of June. Visit our sp_CheckSecurity page to learn about our free SQL Server tool you can download and run to check your own server. Thanks