CVE-2026-77484

Microsoft SQL Server contains a deserialization of untrusted data flaw (CWE-502) in which the database engine processes serialized input without sufficient validation. An attacker who already holds authorized (low-privilege) credentials can trigger it by submitting crafted serialized data over a network connection to the server, with no user interaction required. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability on the SQL Server host. Any organization running an affected SQL Server build is potentially exposed, particularly instances reachable over the network by non-administrative users; the specific affected version ranges are not stated in the available data and should be confirmed in Microsoft's advisory. There is currently no known exploitation: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS estimates only about a 1.1% probability of exploitation within the next 30 days.

What to do: Check Microsoft's security advisory for this CVE to identify affected SQL Server builds and apply the patched release as soon as it is available. Until patched, restrict network access to SQL Server (e.g., port 1433) to trusted networks, minimize the number of low-privileged authenticated accounts that can connect, and review whether untrusted serialized data can reach the server. Monitor EPSS and vendor channels, since exploitation could shift from none_known as PoCs or in-the-wild activity emerge.