CVE-2026-77484 Overview
CVE-2026-77484 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft SQL Server. An authorized attacker can execute arbitrary code over a network by submitting crafted serialized payloads that SQL Server deserializes without proper validation. The flaw affects the confidentiality, integrity, and availability of the database service and the underlying host.
Exploitation requires authenticated network access with low privileges and no user interaction. Successful exploitation lets an attacker run code in the SQL Server service context, enabling data theft, tampering, and lateral movement across connected systems.
Critical Impact
An authenticated attacker with low privileges can achieve remote code execution on SQL Server, compromising database contents and the host operating system.
Affected Products
- Microsoft SQL Server (versions listed in the Microsoft Security Update Guide)
- SQL Server instances exposing database endpoints to authenticated users
- Applications and services running on affected SQL Server hosts
Discovery Timeline
- 2026-09-08 - CVE-2026-77484 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-77484
Vulnerability Analysis
The vulnerability is an insecure deserialization flaw in Microsoft SQL Server. SQL Server deserializes attacker-controlled data without sufficient type or integrity checks. When the server rehydrates the object graph, a crafted payload triggers code execution in the SQL Server process context.
The attack is delivered over the network by a user who already holds valid credentials on the target instance. Exploitation does not require user interaction and does not require administrative privileges. Successful exploitation yields full compromise of the database service, including read and write access to all databases hosted on the instance.
Root Cause
The root cause is unsafe deserialization of untrusted input classified under [CWE-502]. SQL Server accepts serialized data from an authenticated caller and reconstructs objects without enforcing a strict allow-list of permitted types. Deserialization gadgets available in the runtime allow an attacker to steer control flow into arbitrary code paths during object reconstruction.
Attack Vector
The attack vector is network-based. An attacker with low-privileged SQL Server credentials sends a serialized payload to a vulnerable interface on the target instance. SQL Server deserializes the payload and executes the embedded gadget chain in the service account context. The attacker can then execute operating system commands, exfiltrate database content, or pivot to other systems reachable from the SQL Server host.
No verified public exploit code is available at publication. See the Microsoft Security Update Guide for authoritative technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-77484
Indicators of Compromise
- Unexpected child processes spawned by sqlservr.exe, such as cmd.exe, powershell.exe, or rundll32.exe
- Outbound network connections initiated by the SQL Server service to unfamiliar hosts
- New or modified SQL Server logins, roles, or extended stored procedures created outside change control
- Anomalous authentication sessions from low-privileged accounts followed by process creation on the SQL Server host
Detection Strategies
- Baseline normal process trees for sqlservr.exe and alert on deviations, especially command interpreter or scripting host children
- Monitor SQL Server error logs and Extended Events sessions for deserialization exceptions and unusual assembly loads
- Correlate SQL Server authentication events with subsequent host-level process creation and file write activity
Monitoring Recommendations
- Enable SQL Server audit logging for login events, role changes, and execution of xp_cmdshell or CLR assemblies
- Forward Windows Security, Sysmon, and SQL Server audit logs to a centralized analytics platform for correlation
- Track privileged account usage and enforce alerting on any interactive use of SQL service accounts
How to Mitigate CVE-2026-77484
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected SQL Server instances
- Inventory SQL Server deployments and prioritize internet-exposed and multi-tenant instances for patching
- Rotate credentials for any low-privileged SQL logins that could be abused to reach vulnerable endpoints
- Review recent SQL Server audit logs for signs of exploitation prior to patching
Patch Information
Microsoft has published the fix through its regular security update channel. Refer to the Microsoft Security Update Guide for the list of affected builds, cumulative updates, and installation instructions.
Workarounds
- Restrict network access to SQL Server ports using host firewalls and network segmentation until patches are applied
- Enforce least privilege on SQL Server logins and remove unused accounts that could be leveraged by an authenticated attacker
- Disable xp_cmdshell and CLR integration where not required to limit post-exploitation options
- Require strong authentication and monitor all authenticated sessions to SQL Server instances
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
