SQL Server CVE-2019-1068: 2019 RCE Added to CISA KEV
Any SQL Server 2014, 2016 or 2017 instance updated since July 2019 already has the fix; the real work is finding the instances that never got it, now that CISA says attackers are exploiting the bug, and patching or retiring them.
Must act: Owners of SQL Server 2014 SP2/SP3, 2016 SP1/SP2 or 2017 instances (including 2017 on Linux and old container images) still below the July 2019 security update builds, most urgently where internet clients, untrusted users or SQL-injectable apps can send queries.
Can relax: Teams on SQL Server 2019 or later or 2016 SP3, which are not in Microsoft's affected list, and anyone whose affected instances have taken any GDR or CU since July 2019.
- Inventory every SQL Server instance and record its build with SELECT SERVERPROPERTY('ProductVersion'), including SQL Server 2017 on Linux and pinned container images.
- Compare each build with Microsoft's July 2019 table; anything below the fixed GDR or CU build for its baseline is vulnerable.
- Install the latest security update for that baseline on the servicing path you already use, or upgrade; SQL Server 2014 and 2016 are past extended support.