Microsoft SQL Server Remote Code Execution Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2019-1068 · Published 15/07/2019 · updated 27/08/2026

Microsoft SQL Server Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/08/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
sql server microsoft	`= 2014`	No fix yet
sql server 2016 microsoft	`≥ 13.0.4001.0, < 13.0.4259.0≥ 13.0.4411.0, < 13.0.4604.0≥ 13.0.5026.0, < 13.0.5101.9≥ 13.0.5149.0, < 13.0.5366.0`	`13.0.4259.013.0.4604.013.0.5101.913.0.5366.0`
sql server 2017 microsoft	`≥ 14.0.1000.169, < 14.0.2027.2≥ 14.0.3006.16, < 14.0.3192.2`	`14.0.2027.214.0.3192.2`

Description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068 · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-1068

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free