Microsoft extended support for SQL Server 2016 ended on 15 July 2026. Instances still running it receive no security updates, so every vulnerability found from that date onward stays open unless you buy Extended Security Updates. If you are running SQL Server 2016 today, you are running unpatched database software in production right now.