Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2019-1068 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2019 |
| Publication Date | 2026-08-26 |
| Vendor | Microsoft |
| Product | SQL Server (2014, 2016, 2017) |
| CVSS Score | 8.8 (High) |
| EPSS Score | 44.7% (percentile: 99%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-08-29 |
Vulnerability Description
Source: CISA KEV / NVD
Microsoft SQL Server contains a remote code execution vulnerability caused by improper handling of internal functions. A successful attacker executes code in the context of the Database Engine service account — that is, with the privileges the entire SQL Server instance runs under.
The distinction matters: the compromise does not stop at the data in the database. The SQL Server service account is frequently a domain account with excessive privileges, which turns a database flaw into a network foothold.
An EPSS score of 44.7% at the 99th percentile is among the highest values that occur at all — despite the CVE dating from 2019, it is being actively exploited.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 “Prioritizing Security Updates Based on Risk” guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Microsoft’s fix has been available since 2019. If an instance is still vulnerable, that points to a gap in the database patching process — worth addressing more broadly than with a single patch.
CISA’s deadline for US federal agencies: 2026-08-29.
Who Is Affected?
The vulnerability affects Microsoft SQL Server 2014, 2016 and 2017 instances.
MS SQL Server is the default database in mid-size and large companies — from ERP and finance systems to line-of-business applications. Versions 2014–2017 remain widely maintained in production, often because the application running on top of them was never upgraded. Check the patch level on every instance, including “temporary” and development ones — those are the first to fall out of the patching cycle.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
