Executive brief
SQL Server is a database platform used to store and manage business data across organizations. An authorized attacker can exploit an unsafe deserialization vulnerability to execute arbitrary code on the database server over the network, potentially leading to compromise of sensitive data, service disruption, or lateral movement within the network.
Technical details
The vulnerability exists in SQL Server's deserialization routine, which fails to properly validate untrusted serialized data before processing it. An attacker with valid database credentials can craft a malicious serialized payload and send it over the network to trigger arbitrary code execution on the server. The attack requires an existing authenticated session, making it a post-compromise threat vector. Patches are available from Microsoft as detailed in the security advisory CVE-2026-77484.
Affected products
- Microsoft SQL Server
Timeline
- 2026-09-08: disclosed