What’s Vulnerable › Vulnerabilities

CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-08-26
• EPSS: 57.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-15 · updated 2026-08-27
• Weakness: CWE-20

Description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Affected products

• Microsoft SQL Server: 2014-sp2, 2014-sp3
• Microsoft Sql Server 2016: from 13.0.4001.0 before 13.0.4259.0; from 13.0.4411.0 before 13.0.4604.0; from 13.0.5026.0 before 13.0.5101.9; from 13.0.5149.0 before 13.0.5366.0 — fixed in 13.0.4259.0, 13.0.4604.0, 13.0.5101.9, 13.0.5366.0
• Microsoft Sql Server 2017: from 14.0.1000.169 before 14.0.2027.2; from 14.0.3006.16 before 14.0.3192.2 — fixed in 14.0.2027.2, 14.0.3192.2
• Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR): all versions
• Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR): all versions
• Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU): all versions
• Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR): all versions
• Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU): all versions
• Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR): all versions
• Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR): all versions
• Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR): all versions
• Microsoft SQL Server 2017 for x64-based Systems (GDR): all versions
• Microsoft SQL Server: 2014 Service Pack 2 for 32-bit Systems (CU), 2014 Service Pack 2 for x64-based Systems (CU), 2016 for x64-based Systems Service Pack 1 (CU), 2017 for x64-based Systems (CU), 2016 for x64-based Systems Service Pack 2 (CU)

How to fix

Upgrade to a fixed version: Microsoft Sql Server 2016 13.0.4259.0, 13.0.4604.0, 13.0.5101.9, 13.0.5366.0; Microsoft Sql Server 2017 14.0.2027.2, 14.0.3192.2. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068

Get alerted when CVE-2019-1068 or the next vulnerability affects your stack