CVE-2019-1068
Microsoft Sql Server
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Exploitation status
- CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
- US federal civilian agencies are required to remediate it by 2026-08-29. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
- A vendor advisory or patch reference has been published.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s wording, unedited.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, an ordinary user account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 8.8 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness
- CWE-20
- Assigned by
- secure@microsoft.com
Dates
- Published
- 2019-07-15
- Last modified
- 2026-08-27
- Added to KEV
- 2026-08-26
- Remediation due
- 2026-08-29
- Sources
- CISA KEV, NVD
Affected products
- Microsoft Sql Server2014
- Microsoft Sql Server 201613.0.4001.0 - 13.0.4259.0, 13.0.4411.0 - 13.0.4604.0, 13.0.5026.0 - 13.0.5101.9, 13.0.5149.0 - 13.0.5366.0
- Microsoft Sql Server 201714.0.1000.169 - 14.0.2027.2, 14.0.3006.16 - 14.0.3192.2
As listed in the NVD configuration data. Not a statement about your estate.