Summary
generated automatically from NVD dataCVE-2019-1068 is a remote code execution flaw in Microsoft SQL Server, including the 2016 and 2017 releases, caused by incorrect handling of internal functions and classified as CWE-20 (improper input validation). An authenticated attacker with low privileges could exploit it over the network without user interaction, potentially compromising confidentiality, integrity and availability. It is rated 8.8 (HIGH) under CVSS v3.1 and is listed in the CISA KEV catalog, indicating active exploitation.
NVD description
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-08-29
EPSS · FIRST.org
57.3%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 15 juil. 2019
- Updated
- 27 août 2026
- Status
- Analyzed
- Source
- secure@microsoft.com
Affected products
Weaknesses (CWE)
References (3)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1068US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-20
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.