CISA added CVE-2019-1068, a high-severity remote code execution vulnerability in Microsoft SQL Server, to its Known Exploited Vulnerabilities catalog on 2026-08-26 with a three-day remediation deadline.
What Is It
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions. Per CISA, successful exploitation allows an attacker to execute code in the context of the SQL Server Database Engine service account.
NVD rates the issue 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, network-reachable, low attack complexity, no user interaction, but requiring low-level privileges (an authenticated database session). Impact is total across confidentiality, integrity, and availability. The secondary CWE assignment is CWE-20 (Improper Input Validation); NVD's primary weakness mapping is NVD-CWE-noinfo.
Why It Matters
CISA's SSVC assessment marks exploitation as active and technical impact as total, with automatable set to "no." Inclusion in the KEV catalog indicates CISA has evidence of exploitation in the wild, though the agency has not published details of the observed activity. Known ransomware campaign use is listed as Unknown.
The privilege requirement is likely a modest barrier: an account with database access, including one potentially obtained through credential theft or a compromised application service account, could serve as a starting point for code execution under the Database Engine service account, depending on the specific configuration and privileges involved.
What's Vulnerable
Affected Microsoft SQL Server builds include:
- SQL Server 2014 Service Pack 2 (32-bit and x64, GDR and CU branches)
- SQL Server 2014 Service Pack 3 (32-bit and x64, GDR and CU branches)
- SQL Server 2016 Service Pack 1 (x64, GDR and CU)
- SQL Server 2016 Service Pack 2 (x64, GDR and CU)
- SQL Server 2017 (x64, GDR and CU)
NVD CPE data ranges include SQL Server 2016 builds from 13.0.4001.0 up to (but excluding) 13.0.4259.0.
Patch Status
The CVE was published 2019-07-15 and Microsoft's advisory is available through the MSRC security guidance portal. CISA's required action, due 2026-08-29: apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." For cloud services, follow applicable BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines.
Sources
- Microsoft Security Response Center advisory; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
- NVD entry for CVE-2019-1068; https://nvd.nist.gov/vuln/detail/CVE-2019-1068
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk