CVE-2019-1068

This vulnerability lets an attacker run their own code directly on your SQL Server machine. Think of SQL Server as the “engine” that runs your business’s data; this bug can let a bad actor take control of the engine if they can reach it and have enough access to use it.

This matters if you run Microsoft SQL Server, specifically SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR), SQL Server 2014 Service Pack 2 for x64-based Systems (GDR), SQL Server 2014 Service Pack 3 for x64-based Systems (GDR), SQL Server 2016, or SQL Server 2017.

It’s a network-reachable issue by default, and exploitation requires the attacker to have low-privilege access on the SQL Server system. If an attacker can reach your SQL Server over the network and obtain low-level access, then this becomes a direct risk (otherwise it’s much less likely to be exploitable).

This is RED because it is confirmed as actively exploited and listed in CISA’s KEV catalog. Attackers are already using this weakness in the real world, and the fix should be treated as urgent to prevent a compromise.

1. Inventory and verify exposure

   • Identify all SQL Server installations in your environment (including the listed SQL Server variants for 2014 GDR, SQL Server 2016, and SQL Server 2017).
   • For each instance, capture the exact installed version/build number.
   • Determine whether each instance is reachable from untrusted networks (for example, whether SQL Server ports are exposed beyond your trusted internal network).

2. Determine whether you need to patch

   • If you are running SQL Server 2016, the fix is “fixed in 13.0.4259.0”.
   • If you are running SQL Server 2017, the fix is “fixed in 14.0.2027.2”.
   • Compare your installed build to these fixed builds and flag any instances not meeting them.

3. Apply the vendor fix

   • Upgrade SQL Server 2016 instances to a build fixed in 13.0.4259.0 or later.
   • Upgrade SQL Server 2017 instances to a build fixed in 14.0.2027.2 or later.
   • Use Microsoft’s security guidance page for CVE-2019-1068 to follow the recommended update steps for your specific edition/service pack.

4. If patching is delayed: reduce the chance of exploitation

   • Restrict network access so SQL Server is not reachable from the internet and only approved systems/users can connect.
   • Remove or limit low-privilege accounts that don’t need to exist, and review who can authenticate to SQL Server.
   • Follow Microsoft’s guidance for any available mitigations mentioned in the CVE advisory.

5. CISA timing and monitoring

   • CISA KEV remediation due date: 2026-08-29.
   • After changes, monitor SQL Server logs and any security alerts for signs of attempted or successful exploitation (especially around times of unusual login activity or unexpected server-side behavior).

6. Document outcomes

   • Record which instances were updated, the resulting build numbers, and screenshots/log evidence of network restriction changes (if performed).

Severity is high (CVSS 8.8 provided) with network reachability and low required privileges. The weakness is described as incorrect handling of internal functions in Microsoft SQL Server, enabling remote code execution.

Findings indicate: (1) reachable in default configuration, (2) authentication required at a low privilege level, and (3) no user interaction is required. KEV status is confirmed by CISA (listed in CISA KEV with an added date of 2026-08-26 and remediation due date 2026-08-29), meaning exploitation is considered active.

Exploit maturity: While public exploit code is not recorded in the provided findings, the combination of KEV listing, sustained press attention, and “exploitation reported: YES” indicates real-world attacker use. EPSS is listed as rising, but the publicly actionable emphasis is the KEV-confirmed exploitation rather than predictions.

Fixed builds from the findings: SQL Server 2016 fixed in 13.0.4259.0; SQL Server 2017 fixed in 14.0.2027.2.