CVE-2019-1068: Microsoft SQL Server RCE (KEV, re-added 2026)

Checked: 2026-10-29

CVE-2019-1068 is a 2019 remote code execution vulnerability in Microsoft SQL Server's handling of internal functions, patched in Microsoft's July 2019 Patch Tuesday updates; CISA added it to the Known Exploited Vulnerabilities catalog in August 2026 — seven years after disclosure — showing an old, already-patched SQL Server flaw is still being actively exploited on unpatched instances.

Vulnerability summary

Vulnerability ID	CVE-2019-1068
CVSS score	8.8
EPSS score	0.57273
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2019-07-15T19:15:16.983

Affected components

Component	CPE	Version range
Microsoft SQL Server	cpe:2.3:a:microsoft:sql_server_2016::::::::	SQL Server 2014 Service Pack 2 and Service Pack 3; SQL Server 2016 builds 13.0.4001.0-13.0.4258.x, 13.0.4411.0-13.0.4603.x, 13.0.5026.0-13.0.5101.8 and 13.0.5149.0-13.0.5365.x; SQL Server 2017 builds 14.0.1000.169-14.0.2027.1 and 14.0.3006.16-14.0.3192.1 (all fixed by the July 2019 cumulative/GDR updates referenced in Microsoft's advisory)

What this means

CVE-2019-1068 affects Microsoft SQL Server. NVD's description states plainly: "A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'" (NVD).

NVD's own analysis gives this a CVSS v3.1 Primary base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, requiring only low (authenticated) privileges and no user interaction, with high impact to confidentiality, integrity and availability. A Microsoft CNA submission records the identical 8.8 Secondary score. NVD additionally carries a legacy CVSS v2 Primary score of 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P), reflecting the older scoring scheme in use when the CVE was first analyzed in 2019 (NVD).

NVD's CPE applicability data scopes the affected products to: SQL Server 2014 Service Pack 2 and Service Pack 3; SQL Server 2016 in the build ranges 13.0.4001.0 up to (but not including) 13.0.4259.0, 13.0.4411.0 up to 13.0.4604.0, 13.0.5026.0 up to 13.0.5101.9, and 13.0.5149.0 up to 13.0.5366.0; and SQL Server 2017 in the build ranges 14.0.1000.169 up to 14.0.2027.2 and 14.0.3006.16 up to 14.0.3192.2 — all of these ranges end just below the July 2019 patched builds, meaning instances already on the July 2019 or later cumulative/GDR updates are not affected (NVD).

CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26, seven years after the original 2019-07-15 disclosure, with a short required-action due date of 2026-08-29. The catalog entry requires forensic triage and explicitly ties remediation to CISA's Binding Operational Directive BOD 26-04 ("Prioritizing Security Updates Based on Risk"), instructing agencies to apply mitigations per vendor instructions, follow BOD 26-04 guidance for cloud services, or discontinue the product if mitigations are unavailable; known ransomware-campaign use is recorded as "Unknown." Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.57273 (99.071th percentile) — a strikingly high EPSS score for a seven-year-old CVE, consistent with CISA's decision to add it to KEV in 2026 despite the original patch dating to mid-2019 (FIRST EPSS).

Any SQL Server 2014 SP2/SP3, 2016 or 2017 instance that has not received a cumulative or GDR update since July 2019 should be patched immediately per Microsoft's security guidance, and organizations subject to BOD 26-04 should follow the forensic-triage and risk-based patching guidance CISA links directly from the KEV entry.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Remote code execution vulnerability in Microsoft SQL Server caused by incorrect handling of internal functions, letting an authenticated attacker execute code as the Database Engine service account. — NVD
NVD Primary CVSS v3.1 base score is 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, matched by Microsoft's own CNA Secondary submission; a legacy NVD Primary CVSS v2 score of 6.5 is also recorded. — NVD
NVD's CPE data scopes affected products to SQL Server 2014 SP2/SP3 and specific pre-July-2019 build ranges of SQL Server 2016 and 2017, all fixed by the July 2019 cumulative/GDR updates. — NVD
Added to the CISA KEV catalog on 2026-08-26 (seven years after 2019-07-15 disclosure), required-action due date 2026-08-29, forensic triage required, remediation tied to BOD 26-04; known ransomware campaign use recorded as Unknown. Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
EPSS score is 0.57273 (99.071th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.