Microsoft says it's aware of exploit code that's circulating online for an unpatched vulnerability in SQL Server, and is looking into the issue.