Microsoft SQL Server Unsupported Version Detection

Tenable plugin 73756 is a remote version-detection finding, not a proof of exploit. It fingerprints Microsoft SQL Server over the network and flags instances whose self-reported version is past Microsoft support. As of June 1, 2026, that plainly means SQL Server 2014 and earlier are out of support; SQL Server 2016 is still supported until July 14, 2026, so this check should not be used as a blanket 'all old SQL is critical' label.

The vendor severity is overstated for real-world prioritization. Unsupported SQL Server is serious because it stops receiving normal security fixes, which turns every future SQL Server bug into permanent debt, but the plugin itself does not give an attacker code execution, privilege, or data access. You still need a second condition: network reachability, weak auth, a separate SQL Server exploit, or an application path into the instance.

Why this verdict

• Vendor CVSS is synthetic: Tenable assigns a 10.0 manual score to an unsupported state, not to a demonstrated exploit chain.
• Requires attacker reach first: unauthenticated remote access to the SQL listener is the first gate; in many enterprises that already implies internal access or a publishing mistake, which materially narrows exposure.
• Requires a second failure: after version detection, the attacker still needs weak credentials, SQLi, misconfiguration, or a concrete SQL Server vulnerability. That compounding friction pulls this well below Critical.
• High-value data keeps it out of LOW: SQL Server commonly backs finance, ERP, line-of-business apps, and regulated data, so unsupported instances carry meaningful residual risk even without a mapped CVE.
• Population matters: if these are internet-exposed legacy SQL servers, the score trends up locally; if they are segmented internal app backends, the practical risk trends down.

Why not higher?

There is no KEV listing, no EPSS because this is not a CVE, and no evidence that plugin 73756 corresponds to a weaponized exploit by itself. Every meaningful impact path depends on another prerequisite beyond 'old version detected,' which is exactly the kind of friction that should prevent a Critical rating.

Why not lower?

This is still a database platform, not a forgotten desktop app. Unsupported SQL Server turns future security issues into unpatchable exposure, often on systems with sensitive data, privileged service accounts, and downstream business dependencies; that keeps it above simple backlog hygiene.

1. Fence off direct SQL exposure — Restrict inbound access to SQL listeners to known application tiers, admin jump hosts, and approved management networks. For a MEDIUM verdict there is no mitigation SLA, so do this in the current hardening cycle while you work the remediation plan.
2. Kill weak and legacy auth paths — Disable or tightly control SQL authentication where possible, rotate privileged SQL logins, and review any exposed sa-equivalent access. This reduces the most common practical bridge from 'old version' to actual compromise during the 365-day remediation window.
3. Audit dangerous SQL features — Review xp_cmdshell, SQL Agent proxies, linked servers, CLR, and broad sysadmin grants. Unsupported versions become much more dangerous when these post-auth amplifiers are left on, so tighten them now as compensating risk reduction.
4. Prioritize by business tier — Sort findings into internet-exposed, crown-jewel, externally reachable app backends, and everything else. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but tiering tells you which migrations to schedule first.

Run this on the target Windows host that has SQL Server installed. Invoke it with powershell -ExecutionPolicy Bypass -File .\check-sql-unsupported.ps1; local read access to HKLM is usually enough, and admin helps if registry permissions are hardened. The script checks installed SQL Server instances and prints VULNERABLE, PATCHED, or UNKNOWN based on Microsoft support dates as of 2026-06-01.

# check-sql-unsupported.ps1
# Exit codes:
#   0 = PATCHED / supported state
#   1 = VULNERABLE / unsupported SQL Server detected
#   2 = UNKNOWN / unable to determine

$ErrorActionPreference = 'SilentlyContinue'
$asOf = Get-Date '2026-06-01'

function Get-SqlSupportState {
    param(
        [int]$MajorVersion,
        [datetime]$Now
    )

    switch ($MajorVersion) {
        { $_ -le 12 } { return 'VULNERABLE' } # 2014 and earlier unsupported as of 2026-06-01
        13 {
            $eos = Get-Date '2026-07-14T23:59:59'
            if ($Now -gt $eos) { return 'VULNERABLE' } else { return 'PATCHED' }
        }
        { $_ -ge 14 } { return 'PATCHED' } # 2017+ supported on 2026-06-01
        default { return 'UNKNOWN' }
    }
}

function Get-InstanceVersionInfo {
    $results = @()
    $instanceKey = 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL'
    $wowInstanceKey = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\Instance Names\SQL'
    $paths = @($instanceKey, $wowInstanceKey)

    foreach ($path in $paths) {
        if (Test-Path $path) {
            $props = Get-ItemProperty -Path $path
            foreach ($p in $props.PSObject.Properties) {
                if ($p.Name -in @('PSPath','PSParentPath','PSChildName','PSDrive','PSProvider')) { continue }
                $instanceName = $p.Name
                $instanceId = $p.Value
                $setupPath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$instanceId\Setup"
                $wowSetupPath = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Microsoft SQL Server\$instanceId\Setup"
                $setup = $null

                if (Test-Path $setupPath) { $setup = Get-ItemProperty -Path $setupPath }
                elseif (Test-Path $wowSetupPath) { $setup = Get-ItemProperty -Path $wowSetupPath }

                if ($setup) {
                    $ver = $setup.Version
                    if (-not $ver) { $ver = $setup.PatchLevel }
                    $edition = $setup.Edition
                    $major = $null
                    if ($ver -match '^(\d+)\.') { $major = [int]$matches[1] }

                    $results += [PSCustomObject]@{
                        InstanceName = $instanceName
                        InstanceId   = $instanceId
                        Version      = $ver
                        MajorVersion = $major
                        Edition      = $edition
                    }
                } else {
                    $results += [PSCustomObject]@{
                        InstanceName = $instanceName
                        InstanceId   = $instanceId
                        Version      = $null
                        MajorVersion = $null
                        Edition      = $null
                    }
                }
            }
        }
    }

    return $results
}

$instances = Get-InstanceVersionInfo
if (-not $instances -or $instances.Count -eq 0) {
    Write-Output 'UNKNOWN - No SQL Server instances found in expected registry locations.'
    exit 2
}

$overall = 'PATCHED'
$unknownFound = $false
$details = @()

foreach ($i in $instances) {
    if ($null -eq $i.MajorVersion) {
        $state = 'UNKNOWN'
        $unknownFound = $true
    } else {
        $state = Get-SqlSupportState -MajorVersion $i.MajorVersion -Now $asOf
    }

    if ($state -eq 'VULNERABLE') { $overall = 'VULNERABLE' }
    elseif ($state -eq 'UNKNOWN' -and $overall -ne 'VULNERABLE') { $overall = 'UNKNOWN' }

    $details += ('Instance={0}; Version={1}; Edition={2}; State={3}' -f $i.InstanceName, ($i.Version ?? 'unknown'), ($i.Edition ?? 'unknown'), $state)
}

Write-Output ($overall + ' - ' + ($details -join ' | '))

switch ($overall) {
    'PATCHED' { exit 0 }
    'VULNERABLE' { exit 1 }
    default { exit 2 }
}

Sources

1. Tenable plugin 73756
2. Tenable plugin attributes
3. Microsoft SQL Server end-of-support overview
4. Microsoft Lifecycle - SQL Server 2014
5. Microsoft Lifecycle - SQL Server 2016
6. Microsoft Extended Security Updates for SQL Server
7. Microsoft SQL Server firewall / default port guidance
8. CISA Shodan technical guide