MSRXMSRXSecurity
Vulnerabilities / CVE-2019-1068

CVE-2019-1068

Published 2019-07-15 · published (not yet in NVD)

CVE-2019-1068

Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-26, with a fix-by date of 2026-08-29. Patch it first.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

8.8 HIGH
CVSS 3.1 · CNA
57%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

Scores

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCNA

Affected products

  • Microsoft Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR): unspecified
  • Microsoft Microsoft SQL Server: 2014 Service Pack 2 for 32-bit Systems (CU); 2014 Service Pack 2 for x64-based Systems (CU); 2016 for x64-based Systems Service Pack 1 (CU); 2017 for x64-based Systems (CU); 2016 for x64-based Systems Service Pack 2 (CU)
  • Microsoft Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR): unspecified
  • Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR): unspecified
  • Microsoft Microsoft SQL Server 2017 for x64-based Systems (GDR): unspecified
  • Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR): unspecified
  • Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR): unspecified
  • Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU): unspecified
  • Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR): unspecified
  • Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU): unspecified
1 references (advisories, patches, write-ups)

Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVECheck your dependenciesScan a website