Search CVEs, research… / diras.sa
  • CISA KEV
  • EXPLOITED
  • PoC PUBLIC

CVE-2019-1068: remote code execution in Microsoft SQL Server

An attacker who can access Microsoft SQL Server over the network and has a low-privileged account can trigger remote code execution against the Database Engine; this vulnerability is tracked as CVE-2019-1068. Affected builds include multiple Microsoft SQL Server 2014, 2016, and 2017 Service Pack and Cumulative Update branches listed by the vendor. The flaw requires network access and low privileges (no user interaction) and can allow execution with the SQL Server service account privileges.

Published Updated Source: CVE Program, NVD, CISA KEV, FIRST EPSS

CVSS 3.1
8.8HIGH
EPSS
0.57906
CWE
CWE-20
KEV DUE DATE
PATCH
Not yet

DIRAS TAKE

Urgent: this vulnerability was added to CISA’s Known Exploited Vulnerabilities list on 2026-08-26 with a federal remediation deadline of 2026-08-29, so prioritize mitigation for internet-facing and critical SQL Server instances immediately.

What is CVE-2019-1068?

An attacker who can access Microsoft SQL Server over the network and has a low-privileged account can trigger remote code execution against the Database Engine; this vulnerability is tracked as CVE-2019-1068. Affected builds include multiple Microsoft SQL Server 2014, 2016, and 2017 Service Pack and Cumulative Update branches listed by the vendor. The flaw requires network access and low privileges (no user interaction) and can allow execution with the SQL Server service account privileges.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Which versions of Microsoft SQL Server are affected?

BRANCHAFFECTEDFIXED
Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)unspecified
Microsoft SQL Server 2014.x2014 Service Pack 2 for 32-bit Systems (CU)
Microsoft SQL Server 2014.x2014 Service Pack 2 for x64-based Systems (CU)
Microsoft SQL Server 2016.x2016 for x64-based Systems Service Pack 1 (CU)
Microsoft SQL Server 2017.x2017 for x64-based Systems (CU)
Microsoft SQL Server 2016.x2016 for x64-based Systems Service Pack 2 (CU)
Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)unspecified
Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)unspecified
Microsoft SQL Server 2017 for x64-based Systems (GDR)unspecified
Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)unspecified

Is CVE-2019-1068 being exploited?

CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog on 2026-08-26, and U.S. federal agencies must address it by 2026-08-29. Public exploit code is also available.

How to fix CVE-2019-1068

  1. Apply vendor guidance and mitigations from Microsoft immediately.
  2. Restrict network exposure of affected SQL Server instances to trusted networks and management hosts.
  3. Monitor SQL Server logs and endpoint telemetry for suspicious activity and signs of exploitation.
  4. Isolate or remove affected instances from production until mitigations are applied or a vendor patch is available.

Frequently asked questions

Is CVE-2019-1068 being actively exploited?

CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog on 2026-08-26 with a remediation deadline of 2026-08-29 for federal agencies, and public exploit code exists.

Which SQL Server versions are affected by CVE-2019-1068?

Microsoft SQL Server 2014, 2016, and 2017 branches are listed as affected in vendor advisories, including Service Pack and Cumulative Update builds noted by the vendor.

Is there a patch for CVE-2019-1068?

A vendor patch is not listed as available in the provided facts; follow Microsoft guidance and applied mitigations until a fixed release is published.

Does CVE-2019-1068 require authentication?

Yes; the vulnerability requires low-privileged credentials (PR:L) but no user interaction, and it is exploitable over the network.

References