CVE-2019-1068
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
- Score
- CVSS 3.1 8.8 High
- Status
- Analyzed - secure@microsoft.com
- Published
- 2019-07-15
- Last modified
- 2026-08-27
- Known exploited (CISA KEV)
- since 2026-08-26, action due 2026-08-29: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Weaknesses
- CWE-20
Affected products
- Microsoft Sql Server (Microsoft)
- Microsoft Sql Server 2014 Service Pack 2 For 32-bit Systems Gdr (Microsoft)
- Microsoft Sql Server 2014 Service Pack 2 For X64-based Systems Gdr (Microsoft)
- Microsoft Sql Server 2014 Service Pack 3 For 32-bit Systems Cu (Microsoft)
- Microsoft Sql Server 2014 Service Pack 3 For 32-bit Systems Gdr (Microsoft)
- Microsoft Sql Server 2014 Service Pack 3 For X64-based Systems Cu (Microsoft)
- Microsoft Sql Server 2014 Service Pack 3 For X64-based Systems Gdr (Microsoft)
- Microsoft Sql Server 2016 For X64-based Systems Service Pack 1 Gdr (Microsoft)
- Microsoft Sql Server 2016 For X64-based Systems Service Pack 2 Gdr (Microsoft)
- Microsoft Sql Server 2017 For X64-based Systems Gdr (Microsoft)
- Sql Server (Microsoft)
- Sql Server 2016 (Microsoft)
- Sql Server 2017 (Microsoft)
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068
