PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77488 Microsoft CVE debrief

An integer underflow vulnerability exists in Microsoft SQL Server, which could allow an authorized local attacker to disclose information. The vulnerability is rated as MEDIUM with a CVSS score of 5.5. SQL Server administrators and defenders should assess exposure and prioritize patching, especially in environments where local access to SQL Server is possible. This vulnerability affects multiple versions of Microsoft SQL Server, including SQL Server 2017, 2019, 2022, and 2025. Local information disclosure is possible, requiring verification of SQL Server logs. Defenders should monitor SQL Server installations for potential exploitation attempts.

Vendor
Microsoft
Product
Microsoft SQL Server 2017 (CU 31)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-08
Original CVE updated
2026-09-15
Advisory published
2026-09-08
Advisory updated
2026-09-15

Who should care

SQL Server administrators and defenders should assess exposure and prioritize patching, especially in environments where local access to SQL Server is possible.

Why it matters

CVE-2026-77488 is a MEDIUM-rated vulnerability in Microsoft SQL Server that allows local information disclosure. Defenders should prioritize patching, especially in environments with local access to SQL Server.

  • Local information disclosure is possible, requiring verification of SQL Server logs
  • Patching is required to prevent potential exploitation
  • Defenders should monitor SQL Server installations for potential exploitation attempts

Technical summary

The vulnerability exists in multiple versions of Microsoft SQL Server, including SQL Server 2017, 2019, 2022, and 2025. An authorized local attacker could exploit this vulnerability to disclose information. The vulnerability is described as an integer underflow (wrap or wraparound) in SQL Server, allowing an authorized attacker to disclose information locally. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Defensive priority

Defenders should prioritize patching this vulnerability, especially in environments where local access to SQL Server is possible.

Recommended defensive actions

  • Patch SQL Server installations to prevent local information disclosure
  • Verify and apply vendor-provided patches for affected SQL Server versions
  • Monitor SQL Server logs for potential exploitation attempts

Evidence notes

The vulnerability is described as an integer underflow (wrap or wraparound) in SQL Server, allowing an authorized attacker to disclose information locally. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-77488 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-77488

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-77488 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77488

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.