What’s the issue?
Microsoft provides each SQL Server version with a defined lifecycle, typically five years of mainstream support followed by five years of extended support, after which the product reaches end of support and no longer receives security updates or technical assistance.As of 2026, SQL Server 2014 and earlier versions (including 2008, 2008 R2, and 2012) are fully out of support, SQL Server 2016 extended support ends in July 2026, and SQL Server 2017 extended support ends in October 2027.
This finding flags any SQL Server instance running a version that is no longer supported or is approaching end of support.
Why is this a problem?
Running an unsupported SQL Server version exposes the organization to several serious risks. The most immediate is security: Microsoft no longer issues patches for newly discovered vulnerabilities, leaving the instance permanently exposed to any future exploits. Compliance frameworks such as PCI DSS, HIPAA, SOX, and many others explicitly require supported software, so an unsupported instance can cause audit failures and regulatory penalties.Technical support from Microsoft is also unavailable, meaning any production issue must be solved without vendor assistance.
Beyond support concerns, older versions miss out on years of performance improvements, security hardening, and modern features that newer versions provide. Vendor applications increasingly require newer SQL Server versions for certification, and storage, hardware, and operating system platforms eventually drop compatibility with older releases.
What should you do about this?
Inventory all SQL Server instances and determine the version and edition of each by querying SELECT @@VERSION or SERVERPROPERTY(‘ProductVersion’) and SERVERPROPERTY(‘ProductLevel’). Compare each instance against the official Microsoft Lifecycle page to confirm support status.For unsupported instances, plan a migration to a current supported version, ideally the latest release (SQL Server 2025 or 2022 at the time of writing) to maximize the support window going forward. Migration paths include in place upgrades, side by side migrations to a new server, or migration to Azure SQL Database, Azure SQL Managed Instance, or SQL Server on Azure VMs (the last of which can include free or discounted Extended Security Updates).
Test the migration thoroughly, including application compatibility, database compatibility level changes, and any deprecated features that may need rework. If immediate migration is not feasible, evaluate purchasing Extended Security Updates as a temporary bridge while planning the upgrade.