Microsoft extended support for SQL Server 2016 ended on 15 July 2026. Instances still running it receive no security updates, so every vulnerability found from that date onward stays open unless you buy Extended Security Updates. If you are running SQL Server 2016 today, you are running unpatched database software in production right now.
Upgrade in place
Move to SQL Server 2019 or 2022 on the same or new hardware. The cleanest outcome and usually the cheapest over three years — but it needs application compatibility testing, and that is the work most teams underestimate.

