EUVD-2026-73785
GHSA-9c53-qmh3-jjjf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via standard SQL Server port requiring only a low-privilege login; successful deserialization RCE yields full CIA triad impact on the host.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft SQL Server 2019, 2022, and 2025 is achievable by an authenticated low-privilege attacker via deserialization of untrusted data (CWE-502) delivered over the network. The flaw covers multiple build tracks across three major SQL Server versions, with full confidentiality, integrity, and availability impact on the database host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SQL Server authentication credential at minimum low-privilege level (PR:L per the CVSS vector) - this encompasses any SQL Server login, Windows-authenticated domain account granted SQL Server access, or application service account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the core risk well: network-reachable, low-complexity exploitation requiring only a valid SQL Server login - a credential class common in enterprise environments via application service accounts, Windows domain accounts, or SQL logins. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77484. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft SQL Server installations across 2019, 2022, and 2025 builds and identify systems accessible to low-privilege users or applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today