Microsoft SQL Server CVE-2026-77482

The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates that network access to the SQL Server listener is required with no authentication to the database engine, but a user interaction event must be triggered - the exact nature of this interaction is not specified in the available advisory data, and may involve a connected client application processing a crafted server response or executing a specific SQL workflow. Exploitation is limited to SQL Server 2017 and 2019 instances on their respective unpatched GDR and CU branches (versions below 15.0.2190.7/15.0.4490.9 for 2019 and 14.0.2130.4/14.0.3550.4 for 2017); SQL Server 2022 is not listed in the affected version data. Network-level firewall segmentation that blocks untrusted hosts from reaching TCP 1433 reduces the attack surface to adversaries already inside trusted network segments.

The CVSS 8.8 score reflects a genuine high-severity finding: network-reachable, unauthenticated, low-complexity exploitation with full C/I/A impact, held below 9.8 only by the UI:R user-interaction requirement. No EPSS data was supplied, the vulnerability is not in CISA KEV, and no public exploit code has been identified, moderating urgency somewhat. However, the AC:L rating signals that once the user-interaction trigger is met, exploitation is straightforward - even a mid-sized municipal IT team in gliwice running unpatched SQL Server 2017 or 2019 instances exposed on an internal network segment should treat this as urgent given the full remote code execution potential and SQL Server's typical high-privilege service account context. The UI:R constraint may refer to a client-side trigger such as a connected application processing a crafted server response, which could be automatable in certain deployment configurations, narrowing the gap between UI:R and UI:N in practice.

An attacker with network access to TCP port 1433 on an unpatched SQL Server instance sends a crafted request that induces a connected SQL client or application to process malicious data, triggering the heap-based buffer overflow in the SQL Server process. Successful exploitation overwrites heap control structures and redirects execution, yielding code execution under the SQL Server service account - commonly a domain service account or NETWORK SERVICE with significant local and potentially Active Directory privileges. No public exploit code is known at time of analysis, but the low attack complexity rating suggests reliable exploitability once the interaction prerequisite is satisfied.