SQL Server CVE-2019-1068: 2019 RCE Added to CISA KEV

What to do

1. Inventory every SQL Server instance and record its build with SELECT SERVERPROPERTY('ProductVersion'), including SQL Server 2017 on Linux and pinned container images.
2. Compare each build with Microsoft's July 2019 table; anything below the fixed GDR or CU build for its baseline is vulnerable.
3. Install the latest security update for that baseline on the servicing path you already use, or upgrade; SQL Server 2014 and 2016 are past extended support.
4. Block internet access to TCP 1433 and named-instance ports, allowing only application servers and admin hosts.
5. Disable unused SQL logins, rotate shared application passwords, and fix SQL injection in apps that connect with powerful logins.
6. Run the Database Engine under a low-privilege virtual or managed service account, not LocalSystem or a domain admin.

How to check if you are affected or compromised

• Review SQL Server error logs and login auditing for successful logins from unexpected hosts, especially after bursts of failed logins.
• Search EDR telemetry for sqlservr.exe spawning cmd.exe, powershell.exe or other unexpected child processes.
• Check for new logins or sysadmin members (EXEC sp_helpsrvrolemember 'sysadmin'), recently created or changed SQL Agent jobs, and xp_cmdshell being enabled.
• If an unpatched instance was reachable from untrusted networks, preserve logs and a disk image before patching, in line with CISA's forensic-triage flag for this CVE.

What happened#

On July 9, 2019, Microsoft fixed CVE-2019-1068, a remote code execution flaw in the SQL Server Database Engine. Microsoft says the engine "incorrectly handles processing of internal functions," and that an attacker who exploits it can run code "in the context of the SQL Server Database Engine service account." There is one important precondition: "an authenticated attacker would need to submit a specially crafted query." At release, Microsoft marked the bug as publicly disclosed but not exploited and rated it "Exploitation Less Likely." It never published a root-cause write-up. NVD scores it CVSS 3.1 8.8 (network, low privileges, no user interaction).

Seven years later, on August 26, 2026, CISA added the CVE to the KEV catalog in a batch of six "based on evidence of active exploitation." It set a three-day federal deadline of August 29 and marked the entry as requiring forensic triage under BOD 26-04. CISA did not say what it observed. Press coverage notes there is "no public information on how CVE-2019-1068 is being exploited in the wild." As of Oct 21, 2026, we found no vendor, threat-intelligence or incident-response report that names an actor, campaign or victim. CISA lists ransomware use as "Unknown."

Who is affected#

Microsoft lists SQL Server 2014 SP2 and SP3, 2016 SP1 and SP2, and 2017, on both the GDR and CU servicing paths. Its FAQ says the update also applies to SQL Server 2017 on Linux and in Docker containers. The fixed builds for the most common baselines are 12.0.6108.1 (GDR) or 12.0.6293.0 (CU) for 2014 SP3, 13.0.5101.9 or 13.0.5366.0 for 2016 SP2, and 14.0.2027.2 or 14.0.3192.2 for 2017. KB4505225 and its sibling KB articles list the rest. SQL Server 2019 and later, and 2016 SP3, are not in the affected list.

The support situation matters here. According to Microsoft's lifecycle pages, SQL Server 2014 left extended support in July 2024, with paid Extended Security Updates running to July 2027. SQL Server 2016 left extended support in July 2026, and its first ESU year began July 15, 2026. SQL Server 2017 is supported until October 2027. No one publishes a reliable count of unpatched instances. The ones at risk are servers nobody has updated since 2019: appliances with embedded SQL Server, systems whose vendor forbids updates, forgotten VMs, and SQL Server 2017 container images pinned to pre-July-2019 builds.

Do you really need to act?#

Probably not, if you patch SQL Server at all. Microsoft's GDR and CU updates are cumulative, so any security update or CU installed since July 2019 on these versions includes the fix.

If you do find an unpatched build, take it seriously. The login requirement is a lower bar than it sounds. Logins get brute-forced when port 1433 faces the internet, connection strings leak, and a SQL injection flaw in a web app gives an attacker a query channel under that app's login. The attacker's code then runs as the service account. If that account is LocalSystem or a privileged domain account, the host, and possibly the domain, are next.

• Unpatched and reachable from the internet or untrusted networks: act now, and assume compromise is possible.
• Unpatched, internal only, with few logins: patch this week.
• Patched since July 2019, or on 2019 or later: nothing to do for this CVE.

Microsoft lists no workaround.

What to do now#

1. Get each instance's build with sqlcmd -S <host> -Q "SELECT SERVERPROPERTY('ProductVersion'), SERVERPROPERTY('ProductLevel')". Run the same query inside containers and on Linux hosts.
2. Compare the result with the fixed builds above. If it is lower, install the latest security update for that baseline from Microsoft Update or the KB article, staying on the GDR or CU path you already use. Plan upgrades for 2014 and 2016 instances that have no ESU.
3. From outside your network, confirm that 1433 is closed (Test-NetConnection <public-ip> -Port 1433), and restrict named-instance ports the same way.
4. Check which account the engine runs as with SELECT servicename, service_account FROM sys.dm_server_services; and move it off LocalSystem or domain-admin accounts.
5. Disable unused SQL logins, rotate application passwords, and fix SQL injection in any app that connects as a privileged login.

How to tell if you were hit#

No public indicators exist for this CVE, so look for generic signs of SQL Server abuse. Check EDR for sqlservr.exe spawning cmd.exe, powershell.exe or unfamiliar binaries. Review the SQL Server error log and login audit for successful logins from unexpected hosts, especially after bursts of failed logins. Run EXEC sp_helpsrvrolemember 'sysadmin'; to list sysadmin members. Look for recently changed SQL Agent jobs (SELECT name, date_modified FROM msdb.dbo.sysjobs ORDER BY date_modified DESC;) and check whether xp_cmdshell is enabled in sys.configurations. If an exposed instance was unpatched, preserve logs and image the host before you patch or rebuild it.

Timeline#

• Jul 9, 2019 — Microsoft releases security updates for SQL Server 2014, 2016 and 2017 and publishes CVE-2019-1068.
• Jul 15, 2019 — The CVE record is published.
• Jul 9, 2024 — Extended support ends for SQL Server 2014.
• Jul 14, 2026 — Extended support ends for SQL Server 2016.
• Aug 26, 2026 — CISA adds CVE-2019-1068 to KEV, citing evidence of active exploitation.
• Aug 29, 2026 — CISA's remediation deadline for federal agencies.
• Oct 12, 2027 — Extended support ends for SQL Server 2017.

Vulnerability records

• CVE-2019-1068 · KEV 2026-08-26 · A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability msrc.microsoft.com
2. CVE record — CVE-2019-1068 cve.org
3. NVD — CVE-2019-1068 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2019-1068 cisa.gov
5. CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026) cisa.gov
6. Microsoft Support — KB4505225: Security update for SQL Server 2017 CU15 (July 9, 2019) support.microsoft.com
7. Microsoft Lifecycle — SQL Server 2014 learn.microsoft.com
8. Microsoft Lifecycle — SQL Server 2016 learn.microsoft.com
9. Microsoft Lifecycle — SQL Server 2017 learn.microsoft.com

Coverage and analysis

1. The Hacker News — CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs thehackernews.com