Advisory · CVE-2026-77874
Unauthenticated SQL injection in IBM Enterprise Build of Quarkus
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 lets a remote unauthenticated attacker send crafted SQL statements to view, add, modify, or delete information in the back-end database.
- Vendor
- IBM
- Product
- Enterprise Build of Quarkus
- Identifier / CWE
- CVE-2026-77874
CWE-89 - Action timing
- Immediate
Explain it like I’m five
The application asks the database questions but lets strangers write part of the question. A stranger slips in extra instructions, and the database obeys: reading, changing, or deleting records it was never supposed to show.
- 01Crafted request
A remote attacker sends a request containing specially crafted SQL statements.
- 02Injection
The application passes the attacker-controlled input into a database query without proper neutralization.
- 03Database access
The attacker reads, modifies, or deletes rows in the back-end database.
- 04No authentication needed
The attack requires no credentials and no user interaction.
What happened
IBM disclosed a SQL injection vulnerability in IBM Enterprise Build of Quarkus on September 24, 2026. Versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 are affected. A remote unauthenticated attacker can send specially crafted SQL statements that allow viewing, adding, modifying, or deleting information in the back-end database. The issue is rated high at CVSS 8.6.
The bulletin also notes the endpoint is considered automatable, which raises the odds of scanner-driven discovery and mass probing.
What to do
- Inventory applications running the IBM Enterprise Build of Quarkus and confirm the build version.
- Apply the fix described in the IBM security bulletin to affected 3.27.x and 3.33.x lines.
- Restrict network access to affected applications until patched.
- Review database and application logs for anomalous query patterns or unexpected data access around the disclosure date.
- Assess whether data was read or modified; if database integrity cannot be confirmed, begin incident review for the affected data stores.
Management note
Unauthenticated SQL injection in a vendor-supported enterprise Java stack is a direct path to data loss, and the automatable flag means exploitation can be industrialized quickly. Treat this as patch-first, investigate-in-parallel for any internet-facing deployment.