Loading story…
Microsoft disclosed CVE-2026-77487, an SQL Server improper-access-control vulnerability with a CVSS 3.1 base score of 8.8. An authenticated attacker who already has explicit SQL Server permissions can connect over the network and elevate privileges to the sysadmin role, potentially affecting confidentiality, integrity, and availability. Microsoft reported no known public disclosure or active exploitation and assessed exploitation as less likely.
Microsoft has issued fixes through SQL Server servicing releases, including the SQL Server 2017 CU31 GDR security update (KB5122774). Organizations should promptly apply the current GDR/CU package for each supported SQL Server deployment, prioritize instances where non-administrative users have network access, and review SQL permissions to limit unnecessary authenticated access. SQL Server 2017 CU31 and SQL Server 2019 CU32 are their final cumulative updates; those versions will continue receiving applicable security and GDR fixes under lifecycle and extended-support terms.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft documented CVE-2026-77487, an improper-access-control flaw that allows an authenticated user with explicit SQL Server permissions to elevate privileges to SQL sysadmin over the network. Microsoft rated it CVSS 8.8, stated that an official fix was available, and reported no known public disclosure or in-the-wild exploitation at original publication.
Microsoft released SQL Server 2025 CU 8 GDR (KB5122769), SQL Server 2022 CU 26 GDR (KB5122768), SQL Server 2019 CU 32 GDR (KB5122772), and SQL Server 2017 CU 31 GDR (KB5122774) for Linux. The 2019 and 2017 releases were designated the final cumulative updates for those respective versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcelearn.microsoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026
Microsoft released a security update for **CVE-2026-69821**, an important elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS). A locally authenticated attacker with low privileges could exploit the flaw to obtain **SYSTEM** privileges without user interaction, potentially gaining complete control of an affected Windows host. The vulnerability is associated with **CWE-116**, improper encoding or escaping of output, and carries a CVSS v3.1 base score of **7.8**. Microsoft reported that a fix is available and, at disclosure, had found no public disclosure or evidence of exploitation in the wild; it assessed exploitation as less likely.
Sep 9, 2026
Microsoft published security advisories for **SQL Server elevation-of-privilege** vulnerabilities **CVE-2026-26116**, **CVE-2026-26115**, and **CVE-2026-21262**. The guidance directs customers to **update their installed SQL Server version**, noting that any applicable driver fixes are included in the SQL Server updates. The advisories provide update paths across multiple supported SQL Server releases via **GDR and/or CU** packages, instructing administrators to first identify their exact SQL Server build (referencing KB `321185`) and then apply the corresponding security update for their version range. Covered update tracks include SQL Server **2025**, **2022**, **2019**, and **2017**; Microsoft notes that instances on versions not listed are **out of support** and should be upgraded to receive current and future security fixes.
Jul 12, 2026