# CVE-2026-77874

Remote SQL injection in IBM Enterprise Build of Quarkus allowing unauthenticated DB access.

- Page: https://www.vulneraibility.com/cve/CVE-2026-77874
- CVSS: 8.6
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.28% (percentile 20.9)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-24)
- Weakness: CWE-89
- Published: 2026-09-24

## Affected versions

- IBM Enterprise Build of Quarkus: affected >= 3.27.1 and <= 3.27.5.SP1; >= 3.33.1 and <= 3.33.3.SP1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated SQL injection allows attackers to read, add, modify, or delete backend database data.

## Action

Immediate action required

## Recommendation

Apply vendor fixes/mitigations ASAP; sanitize inputs, block/inspect suspicious requests, review logs.

## References

- [patch] https://www.ibm.com/support/pages/node/7289050

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.