{"id":"microsoft-sql-server-attacks-aug-2026","category":"patch","status":"closed","title":"Microsoft SQL Server flaw CVE-2019-1068 exploited in attacks; July 2019 fixes available","tldr":"Attackers are exploiting CVE-2019-1068 in unpatched Microsoft SQL Server databases. Fixes for affected SQL Server 2014, 2016 and 2017 branches date to July 2019. Ask your IT provider to verify every instance is patched and check for compromise.","summary":"CVE-2019-1068 is a flaw in how Microsoft SQL Server processes internal functions. An attacker with database access can use it to run code with the permissions of the database service account. It affects unpatched SQL Server 2014 SP2/SP3, 2016 SP1/SP2 and 2017 installations, including databases supporting business applications. Microsoft released updates for the affected security-only and cumulative-update branches on 9 July 2019. CISA confirmed exploitation by adding the flaw to its catalogue on 26 August 2026. The following day, The Hacker News reported that exploitation details were not public. CERT Vanuatu gives a July 2026 fix date in its advisory, but Microsoft's release records establish July 2019. As at 3 November 2026, fixes are available; the sources reviewed do not establish the attackers, victims, scale of attacks or whether exploitation has stopped.","action":"If your business or family office uses SQL Server, ask its IT provider to verify every database instance has the applicable Microsoft security update or a later update that includes it, including instances bundled with business software. Ask them to check for prior compromise as well as patching.","product":"Microsoft SQL Server 2014, 2016 and 2017","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2019-1068"],"tags":["microsoft","sql-server","database","remote-code-execution","known-exploited"],"affected":["SQL Server 2014 SP2, x86 and x64, GDR and CU branches without the applicable security update","SQL Server 2014 SP3, x86 and x64, GDR and CU branches without the applicable security update","SQL Server 2016 SP1, x64, GDR and CU branches without the applicable security update","SQL Server 2016 SP2, x64, GDR and CU branches without the applicable security update","SQL Server 2017, GDR and CU branches without the applicable security update"],"fixed":["SQL Server 2014 SP2 GDR: KB4505217","SQL Server 2014 SP2 CU+GDR: KB4505419","SQL Server 2014 SP3 GDR: KB4505218","SQL Server 2014 SP3 CU+GDR: KB4505422","SQL Server 2016 SP1 GDR: KB4505219","SQL Server 2016 SP1 CU+GDR: KB4505221","SQL Server 2016 SP2 GDR: KB4505220","SQL Server 2016 SP2 CU+GDR: KB4505222","SQL Server 2017 GDR: KB4505224, build 14.0.2027.2","SQL Server 2017 CU+GDR: KB4505225"],"matches":[],"sources":[{"kind":"advisory","title":"KB4505224 — Security update for SQL Server 2017 GDR: July 9, 2019","url":"https://support.microsoft.com/en-gb/topic/kb4505224-description-of-the-security-update-for-sql-server-2017-gdr-july-9-2019-eef4d1c7-96db-cdce-eedd-ccc54d7fba45","by":"Microsoft","date":"2019-07-09"},{"kind":"advisory","title":"Security update deployment information: July 9, 2019","url":"https://support.microsoft.com/en-us/topic/security-update-deployment-information-july-9-2019-f1c98925-eb74-cd8e-c959-a1744dd587c1","by":"Microsoft","date":"2019-07-09"},{"kind":"advisory","title":"Advisory 203: CVE-2019-1068 — Microsoft SQL Server Remote Code Execution Vulnerability","url":"https://cert.gov.vu/index.php/advisories/219-advisory-203","by":"CERT Vanuatu","date":"2026-08-26"},{"kind":"news","title":"CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs","url":"https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html?m=1","by":"The Hacker News","date":"2026-08-27"}],"started":"2026-08-26","closed":"2026-08-27","created":"2026-11-03T22:14:16.590Z","updated":"2026-11-03T22:14:16.590Z","cve_notes":[{"cve":"CVE-2019-1068","name":"Remote code execution in SQL Server internal functions","what":"Incorrect processing of internal functions in SQL Server lets an attacker with database access run code with the permissions of the Database Engine service account.","severity":"unknown","cvss":8.8}],"timeline":[{"at":"2026-08-27","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"The Hacker News reported that details of how attackers were exploiting the SQL Server flaw had not been made public.","url":"https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html?m=1","by":"The Hacker News","patch":null},{"at":"2026-08-26","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2019-1068 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set 29 August as the remediation deadline for affected US federal civilian agencies.","url":"https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html?m=1","by":"The Hacker News","patch":null},{"at":"2019-07-09","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft released security updates for affected SQL Server 2014, 2016 and 2017 branches. The flaw lets attackers run code with the permissions of the database service account.","url":"https://support.microsoft.com/en-us/topic/security-update-deployment-information-july-9-2019-f1c98925-eb74-cd8e-c959-a1744dd587c1","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/microsoft-sql-server-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=microsoft-sql-server-attacks-aug-2026"}