{"id":"CVE-2019-1068","kind":"vulnerability","aliases":["CVE-2019-1068"],"related":[],"title":"A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of…","description":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Authenticated RCE in SQL Server Database Engine: a crafted query runs code as the engine service account. Fixed July 9, 2019 for SQL Server 2014, 2016 and 2017 (Windows and Linux). Microsoft rated it Important and 'Exploitation Less Likely' at release, but CISA now lists it as exploited. Any instance that has taken updates since July 2019 is already fixed; the risk is unpatched legacy servers.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"Microsoft SQL Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Microsoft SQL Server","fixed":["2014 SP3 GDR 12.0.6108.1","2016 SP2 CU7 13.0.5366.0"],"affected":"2014 SP2/SP3, 2016 SP1/SP2, 2017 below July 2019 security update builds","ecosystem":"vendor"},{"name":"microsoft sql server","fixed":[],"affected":"= 2014","ecosystem":"vendor"},{"name":"microsoft sql server 2016","fixed":["13.0.4259.0"],"affected":">= 13.0.4001.0, < 13.0.4259.0","ecosystem":"vendor"},{"name":"microsoft sql server 2016","fixed":["13.0.4604.0"],"affected":">= 13.0.4411.0, < 13.0.4604.0","ecosystem":"vendor"},{"name":"microsoft sql server 2016","fixed":["13.0.5101.9"],"affected":">= 13.0.5026.0, < 13.0.5101.9","ecosystem":"vendor"},{"name":"microsoft sql server 2016","fixed":["13.0.5366.0"],"affected":">= 13.0.5149.0, < 13.0.5366.0","ecosystem":"vendor"},{"name":"microsoft sql server 2017","fixed":["14.0.2027.2"],"affected":">= 14.0.1000.169, < 14.0.2027.2","ecosystem":"vendor"},{"name":"microsoft sql server 2017","fixed":["14.0.3192.2"],"affected":">= 14.0.3006.16, < 14.0.3192.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","linux","self-hosted","sql-server","vendor","windows"],"not_affected_if":["managed-hosting","no-sql-server-installed","sql-server-2019-or-later"],"how_to_check":"Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the MSRC table. Vulnerable ranges: 2014 SP2 12.0.5000.0-12.0.5214.6 (GDR) or 12.0.5511.0-12.0.5632.1 (CU); 2014 SP3 12.0.6024.0 (GDR) or 12.0.6205.1-12.0.6259.0 (CU); 2016 SP1 13.0.4001.0-13.0.4224.16 or 13.0.4411.0-13.0.4574.0; 2016 SP2 13.0.5026.0-13.0.5081.1 or 13.0.5149.0-13.0.5337.0; 2017 14.0.1000.169-14.0.2014.14 or 14.0.3006.16-14.0.3162.1.","fix":"Install the July 9, 2019 security update (or any later GDR/CU) for your branch. Examples: 2014 SP3 GDR KB4505218 (12.0.6108.1); 2016 SP2 CU7 KB4505222 (13.0.5366.0). Pick GDR or CU to match your servicing path. Unsupported versions: upgrade. Limit who can run queries and run the engine as a low-privilege account.","status":"open","published_at":"2019-07-15T19:15:16+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:47+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:31:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-1068 and follow CISA's required mitigations; if no mitigation is available, discontinue use of the product per the CISA entry.","summary":"Microsoft SQL Server contains a remote code execution flaw that lets an attacker run code in the context of the SQL Server Database Engine service account. CISA lists it in the Known Exploited Vulnerabilities catalog, so it is being used in real attacks.","category":"vendor","who_cares":["sql-server","windows"],"confidence":0.6,"analyst_note":"Sources do not list affected or fixed SQL Server versions or the patch KB; check the Microsoft Security Response Center advisory for CVE-2019-1068 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-sql-server-installed"],"severity_if_unknown":"unknown"},"cost_usd":0.000379,"input_tokens":2198,"output_tokens":318,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed SQL Server versions or the patch KB; check the Microsoft Security Response Center advisory for CVE-2019-1068 and the CISA KEV entry.","search":"'-04':176C,202C,233C '-1068':18A,21A '-2019':17A,20A '2014':89B '2016':34A,38A,42A,46A,90B '2017':50A,54A,92B '2019':85B,121B '26':175C,201C,232C '9':84B 'accord':165C 'account':81B,158C 'action':161C 'adher':229C 'allow':142C 'alreadi':123B 'appli':162C 'applic':199C 'asset':223C 'attack':144C 'authent':65B 'base':180C 'bod':174C,200C,231C 'cisa':107B,159C,172C,189C 'cloud':205C 'code':3A,76B,137C,147C 'complianc':170C 'contain':134C 'context':150C 'could':141C 'craft':73B 'cve':16A,19A 'databas':70B,155C 'discontinu':208C 'engin':71B,79B,156C 'ensur':169C,228C 'evalu':221C 'execut':4A,138C,146C 'exist':6A 'exploit':55B,101B,112B 'exposur':226C 'fix':82B,124B 'follow':198C 'forens':191C 'guidanc':187C,203C 'guidelin':235C 'handl':14A 'host':59B 'import':99B 'incorrect':13A 'instanc':114B 'instruct':168C 'internet':225C 'juli':83B,120B 'legaci':129B 'less':102B 'like':103B 'linux':56B,95B 'list':109B 'microsoft':8A,22A,25A,28A,31A,35A,39A,43A,47A,51A,96B,131C 'mitig':163C,214C 'note':186C,197C 'patch':234C 'priorit':177C 'process':15A 'product':212C 'queri':74B 'rate':97B 'rce':66B 'releas':105B 'remot':2A,136C 'requir':160C,193C 'respons':219C 'risk':126B,182C 'run':75B 'secur':178C 'see':183C,194C 'self':58B 'self-host':57B 'server':10A,24A,27A,30A,33A,37A,41A,45A,49A,53A,62B,69B,88B,130B,133C,154C 'servic':80B,157C,206C 'sinc':119B 'sql':9A,23A,26A,29A,32A,36A,40A,44A,48A,52A,61B,68B,87B,132C,153C 'sql-server':60B 'stakehold':217C 'taken':117B 'triag':192C 'unavail':216C 'unpatch':128B 'updat':118B,179C 'url':184C,195C 'use':209C 'vendor':63B,167C 'vulner':5A,139C 'window':64B,93B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-07-15T19:15:16+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-08-29","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1068","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1068","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-1068:129","url":null,"severity":null,"published_at":"2026-10-23T21:41:21+00:00","modified_at":"2026-10-23T21:41:21+00:00","first_seen_at":"2026-10-23T21:41:21+00:00","fetched_at":"2026-10-23T21:41:21+00:00","note":"MSRC advisory read: affected SQL Server 2014 SP2/SP3, 2016 SP1/SP2, 2017 (incl. Linux) below July 2019 builds; fixes via KB4505217-4505225 series. Patched July 2019; KEV listing (Aug 2026 per secondary sources) means exploitation now. Only fixed builds read on primary pages: 2014 SP3 GDR 12.0.6108.1, 2016 SP2 CU7 13.0.5366.0; others unknown (see MSRC table). No PoC link verified (vulners lists a GitHub exploit entry). Social search skipped."},{"source":"nvd","external_id":"CVE-2019-1068","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1068","severity":null,"published_at":"2019-07-15T19:15:16+00:00","modified_at":"2026-08-27T04:16:38+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1192,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068","title":"MSRC: CVE-2019-1068 SQL Server RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1193,"url":"https://support.microsoft.com/en-us/topic/kb4505218-description-of-the-security-update-for-sql-server-2014-sp3-gdr-july-9-2019-8a85201a-e6e4-8672-064c-a926dae2f769","title":"KB4505218 SQL Server 2014 SP3 GDR","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1195,"url":"https://support.microsoft.com/en-us/topic/kb4505222-description-of-the-security-update-for-sql-server-2016-sp2-cu7-july-9-2019-2225008e-7131-081d-ab18-e74a905c42c9","title":"KB4505222 SQL Server 2016 SP2 CU7","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}