CVE-2026-77486

CVE-2026-77486 is an integer overflow/wraparound flaw (CWE-190) in Microsoft SQL Server that leads to memory corruption (heap-based buffer overflow, CWE-122) when the database engine processes crafted input. An unauthorized (unauthenticated) attacker can trigger it remotely over the network, though the CVSS vector (UI:R) indicates some form of user interaction is required for successful exploitation. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability, so an attacker could run arbitrary code in the context of the SQL Server process. Any organization running a affected supported release of Microsoft SQL Server is potentially exposed; the source data does not specify which version branches are affected, so defenders must consult Microsoft's advisory for exact version ranges. Exploitation status is currently quiet: there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns a 0.6% probability of exploitation within 30 days (roughly the 45th percentile).

What to do: Identify all SQL Server instances in your environment and apply Microsoft's security update for CVE-2026-77486, checking Microsoft's advisory for the exact affected version ranges and update packages since they are not enumerated here. In the interim, restrict exposure of SQL Server (e.g., TCP 1433) to trusted networks only, and because user interaction is part of the attack path, caution users against opening untrusted files, links, or query content that could drive interaction with the server. Monitor Microsoft and CISA channels for updates, as post-disclosure additions to KEV or new PoCs would raise urgency.