Microsoft SQL Server CVE-2026-77484

Exploitation requires a valid SQL Server authentication credential at minimum low-privilege level (PR:L per the CVSS vector) - this encompasses any SQL Server login, Windows-authenticated domain account granted SQL Server access, or application service account. The SQL Server instance must be reachable over the network from the attacker's position (AV:N). No user interaction is required (UI:N). Attack complexity is low (AC:L), meaning no race condition, special timing, or non-reproducible precondition exists beyond possessing valid credentials. The primary limiting factor is the authentication requirement: fully unauthenticated external attackers cannot directly exploit this flaw. Instances with SQL Server ports firewalled to a narrow set of trusted hosts significantly reduce the attacker pool even when low-privilege credentials are compromised.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the core risk well: network-reachable, low-complexity exploitation requiring only a valid SQL Server login - a credential class common in enterprise environments via application service accounts, Windows domain accounts, or SQL logins. The full CIA triad at High reflects that RCE on the SQL Server process yields access to all hosted databases, ability to alter or destroy data, and potential to crash the service. No EPSS data was provided, and the CVE is not listed in CISA KEV, so mass active exploitation is not confirmed; however, the low authentication bar (PR:L) meaningfully lowers the practical attacker barrier compared to PR:H flaws, and even a mid-sized municipal IT team in gniezno should treat this as urgent given how routinely SQL Server instances are reachable from within enterprise networks by application accounts. The absence of a public POC at time of analysis provides limited assurance given the broad attacker population with SQL Server access in typical organizations.

An attacker who has compromised a low-privilege SQL Server login - obtained through credential stuffing, phishing of an application service account, or lateral movement from another internal host - connects to the SQL Server instance over the standard TCP port and submits a crafted serialized payload through an affected API call or feature. The SQL Server deserialization routine processes the payload and executes attacker-controlled code in the context of the SQL Server service account (commonly a domain service account), giving the attacker full read/write access to all databases and a privileged foothold on the Windows host. No public POC has been identified at time of analysis, but the attack pattern follows well-documented .NET deserialization gadget chain techniques.