CVE-2019-1068
Microsoft SQL Server Remote Code Execution Vulnerability
Description
CVE-2019-1068 is a high-severity remote code execution vulnerability in Microsoft SQL Server, arising from incorrect handling of the processing of internal functions. Microsoft published it as "Microsoft SQL Server Remote Code Execution Vulnerability"; an attacker with a low-privileged database account can send crafted input that the server mishandles and thereby execute code in the context of the SQL Server service. Because SQL Server instances hold an organisation's most sensitive structured data and frequently run with broad access inside the network, a database-level foothold converted into code execution is a severe outcome. SQL Server 2014, 2016 and 2017 are affected in specific build ranges. CVE-2019-1068 carries a CVSS score of 8.8 and an exceptionally high EPSS score of roughly 53% at the 99th percentile, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | sql server | 2014 |
| microsoft | sql server 2016 | >= 13.0.4001.0, < 13.0.4259.0; >= 13.0.4411.0, < 13.0.4604.0; >= 13.0.5026.0, < 13.0.5101.9; >= 13.0.5149.0, < 13.0.5366.0 |
| microsoft | sql server 2017 | >= 14.0.1000.169, < 14.0.2027.2; >= 14.0.3006.16, < 14.0.3192.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper input validation occurs when a product receives input but does not validate, or incorrectly validates, that the input has the properties required to process it safely and correctly. In CVE-2019-1068 SQL Server incorrectly handles the processing of internal functions, meaning input reaching those functions is not constrained to the form the downstream code assumes — and the resulting mismatch is what an attacker steers into remote code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2019-1068 is remotely exploitable over the network with low attack complexity and no user interaction, but requires low privileges — the attacker needs an authenticated database connection, which in practice means a legitimate low-privileged SQL login, a credential harvested elsewhere, or a foothold obtained through an application's own database account. From there the impact is high across confidentiality, integrity and availability: code executes with the rights of the SQL Server service, exposing every database on the instance, allowing data to be altered or destroyed, and permitting the service to be stopped. The privilege escalation angle is the critical one: a web application's database user, which is normally confined to reading and writing application tables, becomes a path to executing code on the database host — so an SQL injection flaw elsewhere, or a leaked connection string, chains directly into server compromise. The CVSS 3.1 base score is 8.8 (High), and the EPSS score of approximately 53% in the 99th percentile indicates near-certain ongoing exploitation activity.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-1068 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 29 August 2026 that has already passed. The dominant signal is the EPSS score of roughly 53%, placing this vulnerability in the 99th percentile — an extraordinarily high value indicating that exploitation attempts are continuous rather than occasional, and one of the highest figures assigned to any currently tracked vulnerability. No public exploit code appears among the available references, and Microsoft's MSRC advisory is the only vendor source, which is typical for SQL Server flaws where Microsoft withholds detail; however, a vulnerability from 2019 with an EPSS score at this level has clearly been reverse-engineered and weaponised regardless of what is publicly indexed. Database servers are prime ransomware targets because they hold the data most valuable to extort, so any unpatched affected instance should be treated as a live incident risk.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with Microsoft's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 29 August 2026 has passed.
- Install the Microsoft security update from the MSRC advisory for CVE-2019-1068. Affected builds include SQL Server 2014, SQL Server 2016 in the ranges 13.0.4001.0–13.0.4259.0, 13.0.4411.0–13.0.4604.0, 13.0.5026.0–13.0.5101.9 and 13.0.5149.0–13.0.5366.0, and SQL Server 2017 in 14.0.1000.169–14.0.2027.2 and 14.0.3006.16–14.0.3192.2; verify the resulting build number after patching rather than assuming the update applied.
- Remove SQL Server from network exposure. Database instances should never accept connections from the internet or from general user networks; restrict TCP 1433 and any named-instance ports to application servers and administrative jump hosts at the firewall, which prevents an attacker from reaching the vulnerable surface even with valid credentials obtained elsewhere.
- Apply least privilege to database accounts and reduce the service's own rights. Ensure application logins hold only the permissions they need, remove unused and shared logins, rotate credentials — especially any embedded in connection strings — and run the SQL Server service under a low-privileged dedicated account rather than a highly privileged domain account, so that code execution in the service context yields as little as possible.
- Hunt for compromise and harden long term. Review SQL Server error and audit logs for unexpected logins, repeated service crashes and use of extended stored procedures or
xp_cmdshell, check the host for unfamiliar processes, scheduled tasks and outbound connections, and validate database integrity against backups; then maintain a supported SQL Server version with a defined patch cadence, since SQL Server 2014 in particular is long out of mainstream support and unlikely to receive future fixes.
Technical Details
CVE-2019-1068 is an improper input validation flaw (CWE-20) in Microsoft SQL Server. Microsoft's description states that the vulnerability exists because SQL Server incorrectly handles the processing of internal functions — that is, the validation applied to data flowing into those functions does not guarantee the properties the implementation relies on, so an attacker who can submit queries to the server can drive execution into a state the code was not written to handle. The outcome is remote code execution in the context of the SQL Server service account, which is why the impact metrics are High across all three properties. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H records a network-reachable, low-complexity attack requiring low privileges and no user interaction at unchanged scope; scope remains unchanged because execution occurs as the service, though the practical consequence depends heavily on how privileged that service account is on the host and in the domain. The requirement for an authenticated connection is the only barrier, and in most real environments application database credentials are readily obtainable.
Frequently Asked Questions
Is CVE-2019-1068 being actively exploited?
Yes. CISA added CVE-2019-1068 to its Known Exploited Vulnerabilities catalog with a remediation due date of 29 August 2026, confirming exploitation in the wild, and its EPSS score of about 53% places it in the 99th percentile — among the highest exploitation probabilities of any tracked vulnerability, indicating continuous attack activity.
What products are affected by CVE-2019-1068?
Microsoft SQL Server 2014, 2016 and 2017 are affected. The specific SQL Server 2016 build ranges are 13.0.4001.0–13.0.4259.0, 13.0.4411.0–13.0.4604.0, 13.0.5026.0–13.0.5101.9 and 13.0.5149.0–13.0.5366.0, and for SQL Server 2017 they are 14.0.1000.169–14.0.2027.2 and 14.0.3006.16–14.0.3192.2.
How do I fix CVE-2019-1068?
Install the Microsoft security update referenced in the MSRC advisory for CVE-2019-1068 and verify the resulting build number. Because exploitation requires an authenticated connection, also restrict network access to SQL Server ports, apply least privilege to database logins, rotate credentials in connection strings, and run the SQL Server service under a low-privileged account.
How severe is CVE-2019-1068?
CVE-2019-1068 is rated High with a CVSS 3.1 base score of 8.8. It is network-exploitable with low complexity and no user interaction but requires a low-privileged database account, and it yields remote code execution as the SQL Server service with full confidentiality, integrity and availability impact; with an EPSS score in the 99th percentile and confirmed KEV-listed exploitation past its deadline, patching is urgent.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.