Act nowKnown exploited

Advisory · CVE-2019-1068

A 2019 SQL Server RCE is back on CISA's exploited list

CVE-2019-1068, a remote code execution flaw in SQL Server from 2019, was added to the KEV catalog in 2026: unpatched legacy database servers are being hit.

Advisory published August 26, 2026Independent summary
Vendor
Microsoft
Product
SQL Server
Identifier / CWE
CVE-2019-1068
CWE-20
Action timing
Sep 16, 2026
ELI5

Explain it like I’m five

The database's back door had a faulty lock, and the manufacturer mailed a replacement in 2019. Servers that never installed it are being broken into again now.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privilege access

    The attacker has network access and low-privilege authenticated access to the SQL Server.

  2. 02Internal function abused

    SQL Server mishandles processing of certain internal functions when given crafted input.

  3. 03Code execution

    The mishandling allows the attacker to execute code in the context of the SQL Server Database Engine service account.

  4. 04Database owned

    The service account context typically means broad access to the database engine and its data.

What happened

CISA added CVE-2019-1068 to the Known Exploited Vulnerabilities catalog on August 26, 2026, seven years after the vulnerability was published. A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions. An attacker with low-privilege authenticated network access can execute code in the context of the SQL Server Database Engine service account. It is scored CVSS 8.8.

NVD lists SQL Server 2014 SP2/SP3, SQL Server 2016 builds from 13.0.4001.0 up to 13.0.4259.0, and SQL Server 2017 builds from 14.0.1000.169 up to 14.0.2027.2 as vulnerable. The appearance of a 2019 flaw on the 2026 KEV list means attackers are finding and exploiting database servers that missed years of patching, not that the vulnerability is new.

What to do

  1. Inventory every SQL Server instance and record exact build numbers, including forgotten, embedded, and vendor-managed instances.
  2. Bring SQL Server 2016 to build 13.0.4259.0 or later and SQL Server 2017 to build 14.0.2027.2 or later via the vendor’s security updates; these are the fixed build thresholds NVD data confirms.
  3. SQL Server 2014 SP2/SP3 is long out of support: upgrade, migrate the databases, or isolate the host with no inbound network access from untrusted sources.
  4. Review SQL Server error and audit logs for unexpected code execution or privilege use by low-privilege accounts.
  5. Restrict network access to database ports to only the application servers that need them.

Management note

Nobody gets breached by a zero-day they missed; they get breached by a 2019 patch they never applied. This KEV entry is a proxy metric for patch debt on database infrastructure, and databases hold the data attackers actually want. If a seven-year-old SQL Server flaw is being exploited in your industry, the uncomfortable question is which other legacy systems are carrying the same debt.