CVE-2026-77480

Microsoft SQL Server contains an insufficient-granularity access control flaw (CWE-1220), meaning permissions are enforced more coarsely than intended and can be exceeded by legitimate users. An attacker who already holds a valid low-privileged login can trigger the issue remotely by sending crafted requests to the database over the network, with no user interaction or special conditions required. Successful exploitation elevates the attacker's privileges within the SQL Server instance, yielding high impact to the confidentiality, integrity, and availability of the data it holds (CVSS 3.1 score 8.8). Any organization running Microsoft SQL Server is potentially affected, especially instances that accept network logins from application service accounts, third-party tools, or other low-privileged users. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

What to do: Apply the SQL Server security update Microsoft lists for CVE-2026-77480 in its MSRC advisory, prioritizing instances reachable over the network or used by service and third-party accounts; specific affected versions are not stated in this data, so match the patch to each deployed version. Until patched, restrict which logins and hosts can reach the instance, audit role memberships and explicit permissions held by low-privileged users, and monitor for unexpected privilege changes or newly created privileged logins.