CVE-2026-77874 is a SQL injection vulnerability affecting IBM Enterprise Build of Quarkus in versions >=3.27.1 <=3.27.5.SP1 and >=3.33.1 <=3.33.3.SP1. The vulnerability permits a remote attacker without authentication to inject malicious SQL commands, potentially compromising the confidentiality, integrity, and availability of the backend database. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, low on integrity, and low on availability.

An attacker can remotely exploit this vulnerability without authentication to execute arbitrary SQL commands on the backend database. This can result in unauthorized data disclosure, data modification, and data deletion, impacting the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict access to affected systems and monitor for suspicious activity related to SQL injection attempts.