--- id: "CVE-2019-1068" kind: "vulnerability" aliases: ["CVE-2019-1068"] title: "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of\u2026" severity: "high" cvss: 8.8 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Microsoft SQL Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft SQL Server", "fixed": ["2014 SP3 GDR 12.0.6108.1", "2016 SP2 CU7 13.0.5366.0"], "affected": "2014 SP2/SP3, 2016 SP1/SP2, 2017 below July 2019 security update builds", "ecosystem": "vendor"}, {"name": "microsoft sql server", "fixed": [], "affected": "= 2014", "ecosystem": "vendor"}, {"name": "microsoft sql server 2016", "fixed": ["13.0.4259.0"], "affected": ">= 13.0.4001.0, < 13.0.4259.0", "ecosystem": "vendor"}, {"name": "microsoft sql server 2016", "fixed": ["13.0.4604.0"], "affected": ">= 13.0.4411.0, < 13.0.4604.0", "ecosystem": "vendor"}, {"name": "microsoft sql server 2016", "fixed": ["13.0.5101.9"], "affected": ">= 13.0.5026.0, < 13.0.5101.9", "ecosystem": "vendor"}, {"name": "microsoft sql server 2016", "fixed": ["13.0.5366.0"], "affected": ">= 13.0.5149.0, < 13.0.5366.0", "ecosystem": "vendor"}, {"name": "microsoft sql server 2017", "fixed": ["14.0.2027.2"], "affected": ">= 14.0.1000.169, < 14.0.2027.2", "ecosystem": "vendor"}, {"name": "microsoft sql server 2017", "fixed": ["14.0.3192.2"], "affected": ">= 14.0.3006.16, < 14.0.3192.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "linux", "self-hosted", "sql-server", "vendor", "windows"] not_affected_if: ["managed-hosting", "no-sql-server-installed", "sql-server-2019-or-later"] published_at: "2019-07-15T19:15:16+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1068", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:41:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1068", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of… Authenticated RCE in SQL Server Database Engine: a crafted query runs code as the engine service account. Fixed July 9, 2019 for SQL Server 2014, 2016 and 2017 (Windows and Linux). Microsoft rated it Important and 'Exploitation Less Likely' at release, but CISA now lists it as exploited. Any instance that has taken updates since July 2019 is already fixed; the risk is unpatched legacy servers. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Microsoft SQL Server affected ? fixed ? - vendor:Microsoft SQL Server affected 2014 SP2/SP3, 2016 SP1/SP2, 2017 below July 2019 security update builds fixed 2014 SP3 GDR 12.0.6108.1, 2016 SP2 CU7 13.0.5366.0 - vendor:microsoft sql server affected = 2014 fixed ? - vendor:microsoft sql server 2016 affected >= 13.0.4001.0, < 13.0.4259.0 fixed 13.0.4259.0 - vendor:microsoft sql server 2016 affected >= 13.0.4411.0, < 13.0.4604.0 fixed 13.0.4604.0 - vendor:microsoft sql server 2016 affected >= 13.0.5026.0, < 13.0.5101.9 fixed 13.0.5101.9 - vendor:microsoft sql server 2016 affected >= 13.0.5149.0, < 13.0.5366.0 fixed 13.0.5366.0 - vendor:microsoft sql server 2017 affected >= 14.0.1000.169, < 14.0.2027.2 fixed 14.0.2027.2 - vendor:microsoft sql server 2017 affected >= 14.0.3006.16, < 14.0.3192.2 fixed 14.0.3192.2 ## How to check Run SELECT @@VERSION (or SERVERPROPERTY('ProductVersion')) and compare with the MSRC table. Vulnerable ranges: 2014 SP2 12.0.5000.0-12.0.5214.6 (GDR) or 12.0.5511.0-12.0.5632.1 (CU); 2014 SP3 12.0.6024.0 (GDR) or 12.0.6205.1-12.0.6259.0 (CU); 2016 SP1 13.0.4001.0-13.0.4224.16 or 13.0.4411.0-13.0.4574.0; 2016 SP2 13.0.5026.0-13.0.5081.1 or 13.0.5149.0-13.0.5337.0; 2017 14.0.1000.169-14.0.2014.14 or 14.0.3006.16-14.0.3162.1. ## Fix Install the July 9, 2019 security update (or any later GDR/CU) for your branch. Examples: 2014 SP3 GDR KB4505218 (12.0.6108.1); 2016 SP2 CU7 KB4505222 (13.0.5366.0). Pick GDR or CU to match your servicing path. Unsupported versions: upgrade. Limit who can run queries and run the engine as a low-privilege account. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1068 - 2026-10-23T21:41:21+00:00 analyst — MSRC advisory read: affected SQL Server 2014 SP2/SP3, 2016 SP1/SP2, 2017 (incl. Linux) below July 2019 builds; fixes via KB4505217-4505225 series. Patched July 2019; KEV listing (Aug 2026 per secondary sources) means exploitation now. Only fixed builds read on primary pages: 2014 SP3 GDR 12.0.6108.1, 2016 SP2 CU7 13.0.5366.0; others unknown (see MSRC table). No PoC link verified (vulners lists a GitHub exploit entry). Social search skipped. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-1068 ## Documents - [advisory] MSRC: CVE-2019-1068 SQL Server RCE https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068 - [fix] KB4505218 SQL Server 2014 SP3 GDR https://support.microsoft.com/en-us/topic/kb4505218-description-of-the-security-update-for-sql-server-2014-sp3-gdr-july-9-2019-8a85201a-e6e4-8672-064c-a926dae2f769 - [fix] KB4505222 SQL Server 2016 SP2 CU7 https://support.microsoft.com/en-us/topic/kb4505222-description-of-the-security-update-for-sql-server-2016-sp2-cu7-july-9-2019-2225008e-7131-081d-ab18-e74a905c42c9 ## From the sources Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_