SQL Server privilege escalation and SharePoint XSS: what matters now

TL;DR: An SQL Server elevation-of-privilege flaw, an actively exploited SharePoint XSS bug, and roughly 80 Edge and Chromium fixes are highlighted in Automox's April 2026 Patch Tuesday analysis, with the main commonality being broken input trust and privilege boundaries. The operational takeaway is that exposed services, shared accounts, and delayed browser patching turn separate bugs into one broader access problem.

Editorial analysis by NHI Mgmt Group, based on content published by Automox: “Patch [Fix] Tuesday April 2026: SQL Server Privilege Escalation, SharePoint XSS, and 80 Chromium Fixes”.

By the numbers:

• Microsoft released fixes for approximately 80 Edge and Chromium-based vulnerabilities this cycle.

Key questions

Q: What breaks when SQL Server service accounts are shared across functions?

A: Shared service accounts collapse the boundary between one SQL instance and the rest of the environment.

Q: Why do actively exploited XSS flaws create identity risk, not just web risk?

A: Because XSS can steal session cookies or authentication tokens, the attacker can act as the user without knowing the password.

Q: How do teams know if patch prioritisation is actually reducing identity risk?

A: They should measure how fast exploited privilege-escalation flaws are removed from their highest-value Windows systems, and whether those systems still allow local admin gain from low-level credentials.

Practitioner guidance

• Audit SQL Server role sprawl Identify every account with sysadmin or db_owner rights and reduce access to the minimum necessary for each SQL Server function.
• Eliminate shared service accounts Assign one service account per function so compromise of one SQL workload does not expose other databases or automation paths.
• Patch internet-facing SharePoint first Prioritise on-premises SharePoint servers exposed to the internet before internal instances because the active XSS is reachable without perimeter help.

Bottom line: The article shows three different flaw types, but the governance failure is the same: trust boundaries are too loose around input, privilege, and session use.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →