CVE-2026-77483

CVE-2026-77483 is a weak authentication vulnerability (CWE-1390) in Microsoft SQL Server in which the server does not adequately verify an authenticating network client, allowing an already-authorized, low-privileged user to elevate their privileges over a network. An attacker triggers it by connecting to SQL Server with a legitimate low-privileged account and exploiting the flawed authentication handling, with no user interaction required. Success yields high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8), effectively granting the attacker the data access and control of a more privileged SQL Server identity within the server's own scope. Organizations running SQL Server are in the affected population, particularly instances reachable over the network by holders of database credentials; specific affected version ranges are not provided in the available data. There is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and EPSS estimates roughly a 0.5% probability of exploitation in the next 30 days, so it is not currently known to be exploited.

What to do: Consult Microsoft's Security Update Guide to identify the patched builds for your SQL Server version and apply the security update promptly, prioritizing instances that are reachable over the network. Until patched, restrict inbound access to SQL Server (e.g., TCP/1433) with firewall rules or private networking, minimize and monitor accounts with remote authentication rights, and alert on anomalous authentication or privilege changes. Because this data does not specify affected version ranges, confirm applicability against the official Microsoft advisory rather than assuming all builds are affected.