How to Fix SQL Server Unsupported Version Detection (Nessus 64784 and 73756)

Microsoft SQL Server Unsupported Version Detection means Nessus found a SQL Server instance that Microsoft no longer patches: SQL Server 2014 (extended support ended July 9, 2024), SQL Server 2016 (ended July 14, 2026) or anything older. Fix it by upgrading in place or migrating to SQL Server 2022 or 2025, then applying the latest cumulative update.

Paid Extended Security Updates (ESU) through Azure Arc can keep 2014 and 2016 receiving Critical fixes while you get there. ESU does not close the finding.

What the scanner is actually detecting

Tenable ships two plugins for this finding. Both are in the Databases family and both are rated Critical, with CVSS v2 and v3 base scores of 10.0:

Both plugins compare the instance’s self-reported version number against Microsoft’s support dates. Neither one exploits anything. Tenable set the 10.0 score manually, and its stated rationale is simply that the version is no longer supported. On a credentialed scan you will often get both plugins for the same instance, but it is still one problem.

Real-world risk

There is no specific CVE behind this finding. The problem is what happens next: any SQL Server vulnerability disclosed from now on will get no public fix for these versions. Microsoft’s build list already shows it. In September 2026, SQL Server 2017, 2019, 2022 and 2025 each got new GDR builds, but the newest public build for SQL Server 2016 SP3 is still the July 2026 GDR (13.0.6500.1).

How urgent it is depends on exposure. Most attacks on a database engine begin with a valid login, a compromised application server or a stolen service account. An instance that user subnets can reach on TCP 1433, with SQL logins and broad permissions, deserves priority over an Express instance tied to one application that does not listen on the network at all.

How to confirm it on the host

A single host can run several instances, so list them all:

Get-ItemProperty 'HKLM:SOFTWAREMicrosoftMicrosoft SQL ServerInstance NamesSQL'
Get-Service -Name 'MSSQL*' | Select-Object Name, Status, StartType

The registry key maps each instance name to an instance ID, for example MSSQLSERVER = MSSQL12.MSSQLSERVER. The number after MSSQL is the major version: 11 = 2012, 12 = 2014, 13 = 2016, 14 = 2017, 15 = 2019, 16 = 2022 and 17 = 2025. To get the exact build and edition, query each instance (for the default instance, use -S .):

sqlcmd -S .INSTANCENAME -E -Q "SELECT @@VERSION"

SELECT SERVERPROPERTY('ProductVersion')     AS ProductVersion,
       SERVERPROPERTY('ProductLevel')       AS ProductLevel,
       SERVERPROPERTY('ProductUpdateLevel') AS UpdateLevel,
       SERVERPROPERTY('Edition')            AS Edition;

If you want a complete inventory of SQL Server features on the machine, run Setup.exe /q /ACTION=RunDiscovery from the installation media. The report is saved under %ProgramFiles%Microsoft SQL Server<nnn>Setup BootstrapLog. To see what the remote plugin sees, run this from the scanner’s network:

nmap -p 1433 --script ms-sql-info --script-args mssql.instance-port=1433 <host>

How to fix it

Pick the target version and path

• SQL Server 2025: supported until January 2036. It requires Windows Server 2019 or later, Web edition is gone, and Data Quality Services and Master Data Services have been removed.
• SQL Server 2022: supported until January 11, 2033. It runs on Windows Server 2016 or later.
• SQL Server 2019: already in extended support, which means security fixes only. It buys the least time of the three.

The target version must also support the host OS. SQL Server 2014 running on Windows Server 2012 R2, for example, needs a new server.

Upgrade SQL Server in place

1. Back up every user database plus master, model and msdb, and test the restores. Script out logins, Agent jobs and linked servers.
2. Clear any pending restart and make sure the Windows Installer service is running. Setup blocks the upgrade otherwise.
3. If the target is 2025, read Microsoft’s SQL Server 2025 breaking changes first.
4. Run Setup from the new media at an elevated prompt:

setup.exe /q /ACTION=Upgrade /INSTANCENAME=MSSQLSERVER /INSTANCEID=MSSQLSERVER /PID=<product key> /UpdateEnabled=True /UpdateSource="D:SQLUpdates" /IACCEPTSQLSERVERLICENSETERMS

Notes from Microsoft’s parameter reference:

• /INSTANCEID is required when upgrading from SQL Server 2008 or later.
• Without /PID, Setup uses the Evaluation edition.
• /UpdateSource accepts “MU”, a folder or a UNC share. Point it at the latest CU.
• For an upgrade to 2025, add /IACCEPTDQUNINSTALL if Data Quality Services is installed. The upgrade fails without it.

If you did not include the CU, apply it afterwards:

<package_name>.exe /qs /IAcceptSQLServerLicenseTerms /Action=Patch /AllInstances

Side-by-side migration

Use a side-by-side migration for 2008 and 2012 going to 2025, for an OS the target does not support, or whenever you need a clean fallback. Build the new server with the latest CU. Then recreate what lives outside the user databases: logins, Agent jobs, SSIS packages stored in msdb, linked servers, and server-level triggers. Backups taken on SQL Server 2008 and later restore onto 2022 and 2025. Databases at compatibility level 100 or higher keep their level:

BACKUP DATABASE [AppDB] TO DISK = N'\backupsrvsqlAppDB_full.bak' WITH CHECKSUM, COPY_ONLY;

RESTORE DATABASE [AppDB] FROM DISK = N'\backupsrvsqlAppDB_full.bak'
WITH MOVE N'AppDB' TO N'E:DataAppDB.mdf',
     MOVE N'AppDB_log' TO N'F:LogAppDB_log.ldf',
     CHECKSUM, RECOVERY;

To keep the cutover short for large databases, use log shipping. It works from a primary on 2008 SP3 or 2008 R2 SP2 and later to a 2022 or 2025 secondary. After the final log restore, repoint the DNS alias or connection strings.

Availability groups and failover cluster instances need a rolling upgrade. In an availability group, upgrade the secondaries first, then fail over. In a failover cluster, run Setup on one node at a time, passive nodes first.

Upgraded databases keep their old compatibility level. Take a Query Store baseline, test, and then raise the level:

ALTER DATABASE [AppDB] SET COMPATIBILITY_LEVEL = 160;  -- 170 on SQL Server 2025

If you cannot upgrade in time: ESU via Azure Arc

ESU is available only for SQL Server 2014 and 2016. It ships a fix only when MSRC rates a vulnerability Critical, and it never adds features. To subscribe, connect the instance to Azure Arc. You then pay either through Software Assurance under an EA, EAS, SCE or EES agreement, or pay-as-you-go. On Azure VMs, ESU is free for SQL Server 2014 but not for 2016. If you have only been installing GDRs, install the latest CU first. The finding stays open until you upgrade, so log it in your vulnerability risk acceptance process with an owner and an expiry date.

How to verify the fix and rescan

1. Run SELECT @@VERSION. It should report 16.0.x or 17.0.x. As of September 2026, the latest builds are 16.0.4295.3 (2022 CU27) and 17.0.5005.3 (2025 CU9).
2. Look for failed features in Summary.txt under %ProgramFiles%Microsoft SQL Server<nnn>Setup BootstrapLog.
3. For each retired instance, confirm it no longer appears under Instance NamesSQL.
4. Rescan with credentials so plugin 64784 runs. If it does not, see Windows credentialed scan failures. For 73756, the scanner must be able to reach the instance port.

What can break and how to roll back

• No in-place rollback. Microsoft says the previous instance “is overwritten,” and no backup can be restored to an older version than the one that created it. To roll back, reinstall the old version and restore the pre-upgrade backups, which loses any later changes. A side-by-side migration can be reversed by pointing the alias back before users write to the new server.
• 2025 encryption defaults. Linked servers, publishers with a remote distributor, and remote log shipping monitors can fail under the stricter defaults of OLE DB Driver 19. Install a certificate from a trusted CA before cutover.
• 2025 full-text search. Queries and population against existing version 1 indexes fail until the indexes are rebuilt.
• Query plans. A higher compatibility level changes how the optimizer behaves.

Common false positive reasons

• ESU coverage is not a false positive. The plugins key on the version, so track these instances as accepted risk.
• Bundled Express instances. Many third-party products install their own SQL Server Express. These findings are real, but they are easy to miss. Find the product that owns the instance and ask its vendor for a supported version.
• Stopped or leftover instances. The local check reports installed software whether or not the service is running, and a partial uninstall can leave entries behind.
• Listeners and aliases. Plugin 73756 reports whatever answers on the port. That might be an availability group listener pointing at a replica you have not upgraded yet.
• Plugin feed differences. Both plugins were last modified on July 23, 2026, so scanners running older feeds can disagree.

FAQ

Is SQL Server 2016 still supported?

No. Extended support ended July 14, 2026. Security fixes now come only through paid ESU, for up to three years.

What does SQL Server 2014 end of support mean in practice?

Public security updates stopped on July 9, 2024. After that, Critical fixes come only through ESU, and ESU ends in July 2027.

Can I upgrade SQL Server 2012 directly to SQL Server 2025?

Not in place. You can upgrade 2012 SP4 in place to 2022, or restore its databases onto a new 2025 instance.

Does ESU through Azure Arc clear Nessus 64784 and 73756?

No. ESU delivers patches, but the major version stays unsupported, and the version is what both plugins report.

Tracking this finding across many hosts

Across many hosts, the hard part is keeping track of which instances are upgraded, which are on ESU as accepted risk, and which are retired. If you use SITEY, you upload the .nessus export and it merges duplicate findings from the same scanner. After each instance is upgraded or removed, run a per-finding Nessus retest to confirm that plugins 64784 and 73756 have closed.

Sources

• Tenable: Nessus plugin 64784, Microsoft SQL Server Unsupported Version Detection
• Tenable: Nessus plugin 73756, Microsoft SQL Server Unsupported Version Detection (remote check)
• Microsoft Learn: What are Extended Security Updates for SQL Server?
• Microsoft Learn: Supported version and edition upgrades (SQL Server 2025)
• Microsoft Learn: Latest updates and version history for SQL Server