Microsoft SQL Server CVE-2026-77483

Exploitation requires a valid SQL Server or Windows-authenticated login with at least low-privilege access to the target instance - the CVSS PR:L confirms this. No special non-default configuration is required beyond having a network-reachable SQL Server endpoint (the default deployment posture). The attack is fully remote (AV:N) with no user interaction needed (UI:N). Limiting factors: the attacker must already possess or obtain valid credentials for the SQL Server instance; unauthenticated exploitation is not indicated by the available data. Environments where all SQL logins are tightly controlled, SQL Server is not network-exposed, or Windows Authentication is restricted to specific service accounts face reduced risk.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity, straightforward network exploit requiring only a valid low-privileged SQL or Windows login - a credential that may exist in many enterprise deployments via application service accounts. AC:L indicates no race condition or special timing is required. The full-triad C:H/I:H/A:H impact mirrors sysadmin-level access: an attacker who escalates to sa or sysadmin can read all data, modify schemas and data, execute OS-level commands via xp_cmdshell, and cause denial of service. No public exploit code or KEV listing has been confirmed, which tempers immediate mass-exploitation risk, but the low bar (PR:L, AC:L) means internal or compromised low-privilege accounts represent a credible threat in any environment running an unpatched SQL Server instance. EPSS data was not provided; absence of KEV and POC signals this is not yet widely weaponized but the attack surface is broad given SQL Server's enterprise prevalence.

An attacker with a valid low-privileged SQL login - obtained through credential stuffing, a compromised application service account, or lateral movement - connects to the target SQL Server instance over TCP 1433 and submits a crafted authentication or role-transition request that exploits the weak authentication check to assume sysadmin-level privileges. With elevated access the attacker can enable xp_cmdshell to execute OS commands on the host, exfiltrate the entire database, or drop and recreate schema objects. No public exploit has been confirmed, but the low attack complexity makes manual construction straightforward for a skilled attacker.