CVE-2026-77874 is a high severity (CVSS 8.6) SQL injection in IBM Enterprise Build of Quarkus, in the Hibernate component. It affects 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1. IBM fixed it in 3.27.5.SP2 and 3.33.3.SP2, so upgrade to the matching release.
What's affected
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1. IBM's bulletin lists fixes in 3.27.5.SP2 and 3.33.3.SP2 and says there are no workarounds or mitigations.
The bulletin is a combined one that covers several Quarkus, SmallRye JWT, Hibernate and WebSockets issues. This CVE is the Hibernate SQL injection entry, scored 8.6 by IBM, which matches the record. Because it is a combined bulletin, upgrading to the SP2 releases also picks up the other fixes listed there.
How to check if you're exposed
Find which Quarkus build each service uses. In a Maven project:
mvn dependency:tree | grep -i quarkus
In Gradle, use gradle dependencies and search for quarkus. Check the Quarkus platform or BOM version in your build file, and the version of the IBM Enterprise Build that your container images are built from. Services built on the community Quarkus release are outside this bulletin, though you should read the community advisories for the same components.
What to do now
- Upgrade affected services to IBM Enterprise Build of Quarkus 3.27.5.SP2 or 3.33.3.SP2, following the instructions in IBM's product documentation.
- Rebuild and redeploy every image. A new BOM version does nothing until the artifacts are rebuilt.
- Because IBM lists no workaround, prioritise services that are internet facing and talk to a database.
- Review the other CVEs in the same IBM bulletin for your stack, since the SP2 upgrade covers them together.
Why it matters
This is CWE-89, SQL injection. The database layer accepted attacker-influenced input in a way that let it be read as SQL, rather than as plain data. IBM's description says a remote, unauthenticated attacker could view, add, modify or delete information in the back-end database. The vector confirms the shape: network reachable, no privileges, no user interaction.
The bulletin we fetched does not explain which application patterns trigger the flaw. That matters, because exposure depends on how your code uses the library. A scan can show you which services carry the affected version, and reachability analysis can show whether your code calls the affected path. The record does not flag exploitation in the wild.
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see whether the affected component appears in your project, and reachability analysis helps separate code paths you actually call from ones you only ship.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a web application firewall fix this?
It may block some attempts, but IBM lists no workaround. The fix is the SP2 upgrade.
I use the community Quarkus, am I affected?
This CVE is described for IBM Enterprise Build of Quarkus. Check your own distribution's advisory.
Sources
Last reviewed: 18 October 2026.
