ZeroDayAlert

CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.

Microsoft SQL Server Added to KEV 2026-08-26 Federal due 2026-08-29 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Microsoft SQL Server installations are affected by a remote code execution vulnerability in the Database Engine component. The vulnerability allows an attacker to execute arbitrary code within the security context of the SQL Server service account. The record does not specify which SQL Server versions are vulnerable, nor does it indicate whether this affects on-premises, cloud-hosted, or both deployment models.

How to check whether this touches you

  • Inventory all systems running Microsoft SQL Server, noting the deployment model (on-premises, Azure SQL Database, SQL Server on Azure VMs, etc.).
  • Determine whether each SQL Server instance is reachable from untrusted networks—check firewall rules, network segmentation, and whether port 1433 (or a custom SQL port) is exposed to the internet or shared networks.
  • Retrieve the exact version and build number of each running instance via SELECT @@VERSION; in SQL Server Management Studio or sqlcmd; version strings alone do not confirm patching status, as vendors backport security fixes to older release branches.

What to do

  1. Consult Microsoft's security advisory for CVE-2019-1068 to confirm which versions require patching and obtain the specific patch or cumulative update.
  2. If you cannot patch immediately, apply network-level mitigations: restrict inbound access to SQL Server ports to only trusted hosts and networks, and move instances off the public internet if possible.
  3. Enable SQL Server audit logging to record connection attempts, failed logins, and any suspicious queries; ensure logs are retained for at least 90 days.
  4. Prioritise patching in accordance with CISA BOD 26-04 guidance. If mitigations are unavailable and the instance is internet-exposed, evaluate whether continued operation is acceptable or whether the service should be discontinued.
  5. Escalate to your change management and incident response teams if your environment lacks the ability to patch within the compliance window.

If you find you were exposed

Exploitation typically occurs before disclosure, so retrospective hunting should focus on log entries predating the CISA publication date. Review SQL Server error logs, Windows event logs, and any network intrusion detection logs for failed or anomalous authentication attempts, unusual stored procedure execution, or connections from unexpected IP addresses. Log retention is often the limiting factor; if your retention policy is shorter than several months, cross-reference with firewall and network flow logs to reconstruct access patterns during the exposure window.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2019-1068 is being exploited. It cannot tell you whether SQL Server is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →