Live › vulnerability › CVE-2019-1068
Go to dashboardAuthenticated RCE in SQL Server Database Engine: a crafted query runs code as the engine service account. Fixed July 9, 2019 for SQL Server 2014, 2016 and 2017 (Windows and Linux). Microsoft rated it Important and 'Exploitation Less Likely' at release, but CISA now lists it as exploited. Any instance that has taken updates since July 2019 is already fixed; the risk is unpatched legacy servers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft SQL Server | vendor | – | – |
| Microsoft SQL Server | vendor | 2014 SP2/SP3, 2016 SP1/SP2, 2017 below July 2019 security update builds | 2014 SP3 GDR 12.0.6108.1, 2016 SP2 CU7 13.0.5366.0 |
| microsoft sql server | vendor | = 2014 | – |
| microsoft sql server 2016 | vendor |
| >= 13.0.4001.0, < 13.0.4259.0 |
| 13.0.4259.0 |
| microsoft sql server 2016 | vendor | >= 13.0.4411.0, < 13.0.4604.0 | 13.0.4604.0 |
| microsoft sql server 2016 | vendor | >= 13.0.5026.0, < 13.0.5101.9 | 13.0.5101.9 |
| microsoft sql server 2016 | vendor | >= 13.0.5149.0, < 13.0.5366.0 | 13.0.5366.0 |
| microsoft sql server 2017 | vendor | >= 14.0.1000.169, < 14.0.2027.2 | 14.0.2027.2 |
| microsoft sql server 2017 | vendor | >= 14.0.3006.16, < 14.0.3192.2 | 14.0.3192.2 |
ProductVersion)) and compare with the MSRC table12.0.5000.0-12.0.5214.6 (GDR) or 12.0.5511.0-12.0.5632.1 (CU); 2014 SP3 12.0.6024.0 (GDR) or 12.0.6205.1-12.0.6259.0 (CU); 2016 SP1 13.0.4001.0-13.0.4224.16 or 13.0.4411.0-13.0.4574.0; 2016 SP2 13.0.5026.0-13.0.5081.1 or 13.0.5149.0-13.0.5337.0; 2017 14.0.1000.169-14.0.2014.14 or 14.0.3006.16-14.0.3162.112.0.6108.1); 2016 SP2 CU7 KB4505222 (13.0.5366.0)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2019-1068")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.