CVE-2026-77480: microsoft microsoft sql server 2017 (cu 31)

Vulnerability summary

CVE-2026-77480 is a high (CVSS 8.8) vulnerability in microsoft microsoft sql server 2017 (cu 31). EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55% of scored vulnerabilities.

Timeline

1. 08-09-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

• CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.