Intel

CVE-2019-1068

Microsoft SQL Server — Microsoft SQL Server Remote Code Execution Vulnerability

criticalKEV: actively exploitedPoCEPSS 53%

Description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Source: CISA_KEVNVDCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2019-1068 carries a CVSS v3 score of 8.8 (network-accessible, low complexity, low-privilege authentication sufficient) and sits at the 98.9th EPSS percentile, meaning virtually every other known CVE is considered less likely to be exploited. The vulnerability allows an authenticated SQL user with minimal rights to execute arbitrary code in the context of the SQL Server Database Engine service account — a position that typically translates to full database server compromise and potential lateral movement. For NIS2-scoped KRITIS organisations hosting ERP backends, OT-adjacent data stores, or critical process data on SQL Server, the blast radius is severe. Although CISA has not flagged known ransomware campaign use, the combination of high exploitability and high impact justifies treating this as a P1 patch item; patching should be completed within the next scheduled maintenance window and no later than 72 hours from detection.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Microsoft has released cumulative updates addressing CVE-2019-1068. Target builds are SQL Server 2016 SP1 CU15 / SP2 CU7 and SQL Server 2017 CU16 — look up the exact KB numbers in the Microsoft Security Update Guide under CVE-2019-1068 and deploy without delay.
  • Identify all vulnerable instances: Run SELECT @@VERSION across your SQL Server estate; flag any instance in the ranges 13.0.4001–13.0.5366 (SQL 2016) and 14.0.1000–14.0.3192 (SQL 2017) as vulnerable and prioritise them for patching.
  • Restrict network access: Block inbound TCP/1433 and Named Pipes access to vulnerable instances from all sources except explicitly trusted application-tier IP ranges; any SQL instance reachable from the internet or a DMZ must be isolated behind a firewall or VPN immediately.
  • Audit and rotate privileged accounts: Enumerate all SQL logins holding sysadmin or db_owner roles; disable unused accounts and rotate passwords for the SQL Server Database Engine service account.
  • Enable server-level auditing: Activate SQL Server Audit at the server scope if not already in place and forward logs to your SIEM to capture internal function execution attempts.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place SQL Server instances in a dedicated database VLAN; permit east-west traffic between the application and database tiers only through explicit firewall rules. No direct access from office networks or DMZ segments.
  • Least-privilege SQL logins: Application accounts must hold only the minimum required permissions — revoke EXECUTE rights on system-internal functions for non-administrative accounts (DENY EXECUTE ON … TO [AppUser]).
  • Surface area reduction: Disable features not required for operations: xp_cmdshell, OLE Automation Procedures, and CLR Integration via sp_configure. Each of these expands the attack surface reachable through this vulnerability class.
  • IPS signature activation: Enable network IPS signatures for anomalous TDS (Tabular Data Stream) protocol patterns on port 1433; review Snort/Suricata community rulesets for SQL Server internal-function abuse signatures and activate them.
  • Service account hardening: Run the SQL Server Database Engine service under a Group Managed Service Account (gMSA) with minimal OS privileges — no local administrator membership, no SeDebugPrivilege.
  • Risk-acceptance documentation: If patching cannot be completed within 24 hours, document the exception with compensating controls and an escalation deadline (maximum 72 hours) in line with NIS2 incident-management obligations.

Runbook · Step 3

Detection rules

  • SQL Server Error Log / Audit events: Monitor for internal parser errors (e.g. Error 8624, 8630) in the SQL Server Error Log that may indicate exploitation attempts — SPL: index=sqlserver sourcetype=mssql_errorlog (EventCode=8624 OR EventCode=8630).
  • Sysmon EID 1 — child processes of the SQL service: Alert on ParentImage = sqlservr.exe spawning unexpected children — Sigma shape: ParentImage|endswith: 'sqlservr.exe' AND Image|endswith: ('cmd.exe','powershell.exe','wscript.exe').
  • Network telemetry (Zeek/Suricata): Flag TCP/1433 connections originating from IP ranges outside the defined application VLAN, especially from workstation subnets or internet-facing addresses connecting directly to SQL ports.
  • EDR process tree: Child processes of sqlservr.exe or sqlagent.exe that establish outbound network connections or write files to %TEMP%, %APPDATA%, or C:\Windows\Temp — KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "sqlservr.exe" and FileName in~ ("cmd.exe","powershell.exe","wscript.exe").
  • SQL Server Audit — privileged function calls: Log and alert on EXECUTE AS, OPENROWSET, OPENDATASOURCE, and CLR invocations by non-administrative accounts; baseline normal usage and alert on deviations.

Metrics

Severity
critical
Priority score
233.33
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
98.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
52.8 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-08-26 00:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Modified Analysis2026-08-26 19:43 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    • CVSS V3: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    • CPE Configuration: OR *cpe:2.3:a:microsoft:sql_server:2014:sp2:*:*:*:*:*:* *cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:* *cpe:2.3:a:microsoft:sql_server:2016:sp1:*:*:*:*:x64:* *cpe:2.3:a:microsoft:sql_server:2016:sp2:*:*:*:*:x64:* *cpe:2.3:a:microsoft:sql_server:2017:*:*:*:*:*:x64:* → OR *cpe:2.3:a:microsoft:sql_server:2014:sp2:*:*:*:*:*:* *cpe:2.3:a:microsoft:sql_server:2014:sp3:*:*:*:*:*:* *cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:*:* versions from (including) 13.0.4001.0 up to (excluding) 13.0.4259.0 *cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:*:* versions from (including) 13.0.4411.0 up to (excluding) 13.0.4604.0 *cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:*:* versions from (including) 13.0.5026.0 up to (excluding) 13.0.5101.9 *cpe:2.3:a:microsoft:sql_server_2016:*:*:*:*:*:*:*:* versions from (including) 13.0.5149.0 up to (excluding) 13.0.5366.0 *cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:*:* versions from (including) 14.0.1000.169 up to (excluding) 14.0.2027.2 *cpe:2.3:a:microsoft:sql_server_2017:*:*:*:*:*:*:*:* versions from (including) 14.0.3006.16 up to (excluding) 14.0.3192.2
    • Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068 Types: US Government Resource
  2. CVE CISA KEV Update2026-08-26 19:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-08-26
    • Due Date: 2026-08-26
    • Required Action: 2026-08-26
    • Vulnerability Name: 2026-08-26
  3. CVE Modified2026-08-26 18:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068
    • SSVC: {"id":"CVE-2019-1068","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalIm… → {"id":"CVE-2019-1068","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technical…
  4. CVE Modified2026-08-26 16:16 UTC· secure@microsoft.com
    • Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
    • Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
    • Reference Type: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068 Types: Patch, Vendor Advisory
  5. CVE Modified2026-08-26 16:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-20
    • SSVC: {"id":"CVE-2019-1068","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalIm…

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • microsoft

    sql_server

  • microsoft

    sql_server_201613.0.4001.0 – 13.0.4259.0

  • microsoft

    sql_server_201613.0.4411.0 – 13.0.4604.0

  • microsoft

    sql_server_201613.0.5026.0 – 13.0.5101.9

  • microsoft

    sql_server_201613.0.5149.0 – 13.0.5366.0

  • microsoft

    sql_server_201714.0.1000.169 – 14.0.2027.2

  • microsoft

    sql_server_201714.0.3006.16 – 14.0.3192.2

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2019-1068
Microsoft SQL Server — Microsoft SQL Server Remote Code Execution Vulnerability — CVE-2019-1068 | NEOSEC Intel